@learncard/network-brain-service 3.18.0 → 3.19.0

package/src/routes/credential-refreshes.test.ts

@@ -116,7 +116,10 @@ describe('credential refresh issuer route gating', () => {
                 markConstraintsReady = resolve;
             })
         );
-        mocks.sendRefreshableCredential.mockResolvedValue('lc:network:credential:root');
+        mocks.sendRefreshableCredential.mockResolvedValue({
+            uri: 'lc:network:credential:root',
+            receipt: { refreshId: 'opaque-refresh-id' },
+        });
 
         const caller = credentialRefreshesRouter.createCaller({
             domain: 'network.example.com',
@@ -174,7 +177,10 @@ describe('credential refresh issuer route gating', () => {
 
     it('forwards initial notification suppression to managed delivery', async () => {
         process.env.CREDENTIAL_REFRESH_ENABLED = 'true';
-        mocks.sendRefreshableCredential.mockResolvedValue('lc:network:credential:root');
+        mocks.sendRefreshableCredential.mockResolvedValue({
+            uri: 'lc:network:credential:root',
+            receipt: { refreshId: 'opaque-refresh-id' },
+        });
 
         const caller = credentialRefreshesRouter.createCaller({
             domain: 'network.example.com',

package/src/routes/credential-refreshes.ts

@@ -124,7 +124,7 @@ export const credentialRefreshesRouter = t.router({
         .mutation(async ({ ctx, input }) => {
             const { profile } = ctx.user;
 
-            return sendRefreshableCredential({
+            const { uri } = await sendRefreshableCredential({
                 issuerProfile: profile,
                 refreshId: input.refreshId,
                 credential: input.credential,
@@ -132,6 +132,8 @@ export const credentialRefreshesRouter = t.router({
                 skipNotification: input.skipNotification,
                 domain: ctx.domain,
             });
+
+            return uri;
         }),
 
     publishCredentialRefresh: credentialRefreshRoute
@@ -156,6 +158,7 @@ export const credentialRefreshesRouter = t.router({
                 issuerProfile: profile,
                 input: input as PublishCredentialRefreshInput,
                 domain: ctx.domain,
+                branding: ctx.tenant?.emailBranding,
             });
         }),
 

package/src/routes/credentials.ts

@@ -71,6 +71,7 @@ export const credentialsRouter = t.router({
             // Log credential activity FIRST to get activityId
             const activityId = await logCredentialSent({
                 actorProfileId: profile.profileId,
+                onBehalfOf: ctx.user.onBehalfOf,
                 recipientType: 'profile',
                 recipientIdentifier: targetProfile.profileId,
                 recipientProfileId: targetProfile.profileId,
@@ -118,7 +119,7 @@ export const credentialsRouter = t.router({
             const { profile } = ctx.user;
             const { uri } = input;
 
-            return acceptCredential(profile, uri, input?.options ?? {});
+            return acceptCredential(profile, uri, input?.options ?? {}, ctx.tenant?.emailBranding);
         }),
 
     receivedCredentials: profileRoute

package/src/routes/inbox.ts

@@ -1,3 +1,12 @@
+import { trace } from '@tracing';
+import { submitInboxBatch, getInboxBatch } from '@helpers/inbox-queue.helpers';
+import {
+    assertInboxRefreshEnabled,
+    inboxRefreshRequestDigest,
+    getInboxRefreshReplay,
+    getInboxRefreshReceipt,
+    resumeInboxRefreshDelivery,
+} from '@helpers/inbox-refresh.helpers';
 import { getDidWeb } from '@helpers/did.helpers';
 import { TRPCError } from '@trpc/server';
 import { z } from 'zod';
@@ -6,6 +15,9 @@ import { t, profileRoute, openRoute, verifiedContactRoute, scopedRoute } from '@
 import {
     PaginationOptionsValidator,
     IssueInboxCredentialValidator,
+    IssueInboxCredentialBatchValidator,
+    InboxBatchReceiptValidator,
+    InboxBatchStatusValidator,
     IssueInboxCredentialResponseValidator,
     InboxCredentialValidator,
     PaginatedInboxCredentialsValidator,
@@ -18,15 +30,14 @@ import {
     JWEValidator,
 } from '@learncard/types';
 import { getInboxCredentialMeta } from '@helpers/credential-meta.helpers';
-import { claimIntoInbox, issueToInbox } from '@helpers/inbox.helpers';
-import { prepareCredentialFromBoost, getBoostUri } from '@helpers/boost.helpers';
+import { claimIntoInbox, issueToInbox, resolveInboxCredentialInput } from '@helpers/inbox.helpers';
 import {
     hasMustacheVariables,
     renderBoostTemplate,
     parseRenderedTemplate,
 } from '@helpers/template.helpers';
 import { getProfileByVerifiedContactMethod } from '@accesslayer/contact-method/relationships/read';
-import { getBoostByUri, getBoostsForProfile } from '@accesslayer/boost/read';
+import { getBoostsForProfile } from '@accesslayer/boost/read';
 import {
     generateGuardianApprovalToken,
     generateGuardianApprovalUrl,
@@ -447,55 +458,36 @@ export const inboxRouter = t.router({
         .output(IssueInboxCredentialResponseValidator)
         .mutation(async ({ ctx, input }) => {
             const { profile } = ctx.user;
-            const { recipient, credential: inputCredential, templateUri, configuration } = input;
-
-            // Resolve credential from templateUri if provided
-            let credential = inputCredential;
-            let resolvedBoostUri: string | undefined;
-
-            if (templateUri && !credential) {
-                const boostInstance = await getBoostByUri(templateUri);
-
-                if (!boostInstance) {
-                    throw new TRPCError({
-                        code: 'NOT_FOUND',
-                        message: `Boost not found: ${templateUri}`,
-                    });
-                }
-
-                if (!boostInstance.dataValues.boost) {
-                    throw new TRPCError({
-                        code: 'BAD_REQUEST',
-                        message: `Boost does not contain a credential template: ${templateUri}`,
-                    });
-                }
+            const { recipient, configuration } = input;
 
-                try {
-                    // Use shared helper to prepare credential with templateData rendering,
-                    // issuance date, boostId injection, and OBv3 alignments
-                    resolvedBoostUri = getBoostUri(boostInstance.id, ctx.domain);
-
-                    credential = await prepareCredentialFromBoost(
-                        boostInstance,
-                        resolvedBoostUri,
-                        ctx.domain,
-                        { templateData: configuration?.templateData as Record<string, unknown> }
+            const refreshDigest = input.refresh ? inboxRefreshRequestDigest(input) : undefined;
+            if (input.refresh) {
+                await assertInboxRefreshEnabled(ctx.user.scope);
+                const replay = await getInboxRefreshReplay(
+                    profile.profileId,
+                    input.idempotencyKey,
+                    refreshDigest!
+                );
+                if (replay && (replay.claimUrl || replay.inbox.currentStatus !== 'PENDING')) {
+                    await resumeInboxRefreshDelivery(replay.inbox.refreshId!, ctx.domain);
+                    const receipt = await getInboxRefreshReceipt(
+                        replay.inbox.refreshId!,
+                        ctx.domain
                     );
-                } catch (e) {
-                    console.error('Failed to prepare boost credential', e);
-                    throw new TRPCError({
-                        code: 'BAD_REQUEST',
-                        message: `Failed to prepare boost credential template: ${templateUri}`,
-                    });
+                    return {
+                        issuanceId: replay.inbox.id,
+                        status: replay.inbox.currentStatus,
+                        recipient,
+                        claimUrl: replay.claimUrl,
+                        refresh: receipt,
+                        ...(replay.inbox.currentStatus === 'ISSUED'
+                            ? { recipientDid: receipt.holderDid }
+                            : {}),
+                    };
                 }
             }
 
-            if (!credential) {
-                throw new TRPCError({
-                    code: 'BAD_REQUEST',
-                    message: 'Either credential or templateUri must be provided',
-                });
-            }
+            const { credential, resolvedBoostUri } = await resolveInboxCredentialInput(input, ctx);
 
             // Normalize signing authority name if provided
             const normalizedConfiguration = configuration?.signingAuthority
@@ -513,11 +505,18 @@ export const inboxRouter = t.router({
                     profile,
                     recipient,
                     credential,
-                    normalizedConfiguration,
+                    {
+                        ...normalizedConfiguration,
+                        boostUri: resolvedBoostUri,
+                        refresh: input.refresh,
+                        idempotencyKey: input.idempotencyKey,
+                        refreshRequestDigest: refreshDigest,
+                    },
                     ctx
                 );
 
                 return {
+                    refresh: result.refresh,
                     issuanceId: result.inboxCredential.id,
                     status: result.status,
                     recipient,
@@ -536,6 +535,42 @@ export const inboxRouter = t.router({
             }
         }),
 
+    issueBatch: profileRoute
+        .meta({
+            openapi: {
+                protect: true,
+                method: 'POST',
+                path: '/inbox/issue-batch',
+                tags: ['Universal Inbox'],
+                summary: 'Issue Credentials to Universal Inbox (Batch)',
+                description:
+                    'Queue 1–100 credentials for background issuance. Returns a durable batch ID; poll GET /inbox/batches/{batchId} for ordered results. Request and item idempotency keys are issuer-scoped for 24 hours. Maximum JSON payload: 4 MiB.',
+            },
+            requiredScope: 'inbox:write',
+        })
+        .input(IssueInboxCredentialBatchValidator)
+        .output(InboxBatchReceiptValidator)
+        .mutation(({ ctx, input }) =>
+            trace('route', 'issueBatch', () => submitInboxBatch(ctx.user.profile, input, ctx), {
+                itemCount: input.items.length,
+            })
+        ),
+
+    getBatch: profileRoute
+        .meta({
+            openapi: {
+                protect: true,
+                method: 'GET',
+                path: '/inbox/batches/{batchId}',
+                tags: ['Universal Inbox'],
+                summary: 'Get Inbox Batch Progress',
+            },
+            requiredScope: 'inbox:read',
+        })
+        .input(z.object({ batchId: z.string() }))
+        .output(InboxBatchStatusValidator)
+        .query(({ ctx, input }) => getInboxBatch(ctx.user.profile.profileId, input.batchId)),
+
     claim: verifiedContactRoute
         .meta({
             openapi: {
@@ -682,6 +717,7 @@ export const inboxRouter = t.router({
             // Log initial activity so embed claims appear in the dashboard
             const activityId = await logCredentialSent({
                 actorProfileId: issuerProfile.profileId,
+                onBehalfOf: ctx.user?.onBehalfOf,
                 recipientType: contactMethod.type as 'email' | 'phone',
                 recipientIdentifier: contactMethod.value,
                 integrationId: integration.id,
@@ -825,7 +861,17 @@ export const inboxRouter = t.router({
                 });
             }
 
-            return inboxCredential;
+            return {
+                ...inboxCredential,
+                ...(inboxCredential.refreshId
+                    ? {
+                          refresh: await getInboxRefreshReceipt(
+                              inboxCredential.refreshId,
+                              ctx.domain
+                          ),
+                      }
+                    : {}),
+            };
         }),
 
     // ─── Guardian Credential Approval Routes ─────────────────────────────────────

package/src/routes/index.ts

@@ -9,7 +9,7 @@ import { CreateFastifyContextOptions } from '@trpc/server/adapters/fastify';
 import { OpenApiMeta } from 'trpc-to-openapi';
 import jwtDecode from 'jwt-decode';
 import * as Sentry from '@sentry/serverless';
-import { AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX } from '@learncard/types';
+import { ACT_AS_HEADER, AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX } from '@learncard/types';
 import { ContactMethodType } from '@learncard/types';
 
 import { RegExpTransformer } from '@learncard/helpers';
@@ -48,7 +48,11 @@ export type Context = {
         did: string;
         isChallengeValid: boolean;
         scope?: string;
+        isAuthGrant?: boolean;
+        actAsPolicy?: string;
+        onBehalfOf?: string;
     };
+    actAs?: string;
     contactMethod?: ContactMethodType;
     domain: string;
     tenant: ResolvedTenant;
@@ -84,6 +88,14 @@ export const createContext = async (
         | { req: { headers: Map<string, string> } }
 ): Promise<Context> => {
     const event = 'event' in options ? options.event : options.req;
+    const headerEntries =
+        'get' in event.headers
+            ? Array.from(event.headers as Map<string, string>)
+            : Object.entries(event.headers);
+    const rawActAs = headerEntries.find(
+        ([name]) => name.toLowerCase() === ACT_AS_HEADER.toLowerCase()
+    )?.[1];
+    const actAs = Array.isArray(rawActAs) ? rawActAs.join(',') : rawActAs;
     const authHeader =
         'get' in event.headers
             ? (event.headers as Map<string, string>).get('authorization')
@@ -141,6 +153,7 @@ export const createContext = async (
                 if (!challenge)
                     return {
                         user: { did, isChallengeValid: false, scope: AUTH_GRANT_NO_ACCESS_SCOPE },
+                        actAs,
                         domain,
                         tenant,
                         sourceIp,
@@ -148,6 +161,8 @@ export const createContext = async (
 
                 let isChallengeValid = false;
                 let scope = AUTH_GRANT_FULL_ACCESS_SCOPE;
+                let isAuthGrant = false;
+                let actAsPolicy: string | undefined;
 
                 // If the user is using a provisional auth token for a contact method:
                 if (challenge?.includes(CONTACT_METHOD_SESSION_PREFIX)) {
@@ -159,6 +174,7 @@ export const createContext = async (
                         if (!contactMethod) throw new TRPCError({ code: 'NOT_FOUND' });
                         return {
                             contactMethod,
+                            actAs,
                             domain,
                             tenant,
                             sourceIp,
@@ -166,9 +182,14 @@ export const createContext = async (
                     }
                     // If the user is using a real auth grant i.e. an API Token.
                 } else if (challenge?.includes(AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX)) {
-                    const { isChallengeValid: _isChallengeValid, scope: _scope } =
-                        await isAuthGrantChallengeValidForDID(challenge, did);
-
+                    const {
+                        isChallengeValid: _isChallengeValid,
+                        scope: _scope,
+                        actAs: policy,
+                    } = await isAuthGrantChallengeValidForDID(challenge, did);
+
+                    isAuthGrant = true;
+                    actAsPolicy = policy;
                     isChallengeValid = _isChallengeValid;
                     scope = _scope;
                     // If the user is using a real challenge signed by their private key.
@@ -182,7 +203,8 @@ export const createContext = async (
                 Sentry.setUser({ id: did });
 
                 return {
-                    user: { did, isChallengeValid, scope },
+                    user: { did, isChallengeValid, scope, isAuthGrant, actAsPolicy },
+                    actAs,
                     domain,
                     tenant,
                     _guardianApprovalToken,
@@ -192,7 +214,7 @@ export const createContext = async (
         }
     }
 
-    return { domain, tenant, _guardianApprovalToken, sourceIp };
+    return { domain, tenant, _guardianApprovalToken, sourceIp, actAs };
 };
 
 export const openRoute = t.procedure
@@ -245,6 +267,55 @@ export const resolveProfileFromContextDid = async (
     return getProfileByDid(did);
 };
 
+type ActingUser = NonNullable<Context['user']> & { profile: ProfileType | null };
+
+const resolveActAs = async (
+    user: ActingUser,
+    actAs: string | undefined,
+    domain: string
+): Promise<ActingUser> => {
+    const requested = actAs?.trim();
+    if (!requested) return user;
+
+    const { profile } = user;
+    const prefix = `did:web:${domain}:users:`;
+    const profileId = requested.startsWith(prefix) ? requested.slice(prefix.length) : requested;
+    if (!profileId || /[:/?#]/.test(profileId)) {
+        throw new TRPCError({ code: 'BAD_REQUEST', message: 'Invalid act-as profile identifier' });
+    }
+
+    // Two DB lookups per request when the act-as header is present (target profile,
+    // then its managers) — acceptable at backend issuance volume; not worth caching.
+    const target = await getProfileByProfileId(profileId);
+    if (!target)
+        throw new TRPCError({ code: 'NOT_FOUND', message: 'Act-as target profile not found' });
+
+    const managers = await getProfilesThatManageAProfile(target.profileId);
+    if (!profile || !managers.some(manager => manager.profileId === profile.profileId)) {
+        throw new TRPCError({
+            code: 'FORBIDDEN',
+            message: `You do not manage profile "${profileId}".`,
+        });
+    }
+
+    const policy = user.actAsPolicy;
+    const permitted =
+        policy === '*' ||
+        policy
+            ?.split(',')
+            .map(id => id.trim())
+            .includes(target.profileId);
+    if (user.isAuthGrant && !permitted) {
+        throw new TRPCError({
+            code: 'FORBIDDEN',
+            message: `This API token may not act as "${profileId}". Grant actAs on the token.`,
+        });
+    }
+
+    Sentry.setUser({ id: target.profileId, username: target.displayName });
+    return { ...user, profile: target, did: target.did, onBehalfOf: profile.profileId };
+};
+
 export const didRoute = openRoute.use(async ({ ctx, next }) => {
     if (!ctx.user?.did) {
         throw new TRPCError({ code: 'UNAUTHORIZED' });
@@ -254,7 +325,11 @@ export const didRoute = openRoute.use(async ({ ctx, next }) => {
 
     if (profile) Sentry.setUser({ id: profile.profileId, username: profile.displayName });
 
-    return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
+    const user = ctx.user.isChallengeValid
+        ? await resolveActAs({ ...ctx.user, profile }, ctx.actAs, ctx.domain)
+        : { ...ctx.user, profile };
+
+    return next({ ctx: { ...ctx, user } });
 });
 
 export const didAndChallengeRoute = didRoute.use(({ ctx, next }) => {

package/src/routes/skills.ts

@@ -241,7 +241,7 @@ export const skillsRouter = t.router({
 
                 if (rateCount > SEMANTIC_SEARCH_RATE_LIMIT_PER_MIN) {
                     throw new TRPCError({
-                        code: 'TOO_MANY_REQUESTS' as 'BAD_REQUEST',
+                        code: 'TOO_MANY_REQUESTS',
                         message: `Rate limit exceeded: max ${SEMANTIC_SEARCH_RATE_LIMIT_PER_MIN} semantic searches per minute`,
                     });
                 }

package/src/routes/workflows.ts

@@ -1,3 +1,4 @@
+import { finalizeInboxRefresh } from '@helpers/inbox-refresh.helpers';
 import { TRPCError } from '@trpc/server';
 import { z } from 'zod';
 import base64url from 'base64url';
@@ -606,14 +607,28 @@ async function handleInboxClaimPresentation(
     const credentialProcessingPromises = pendingCredentials.map(async inboxCredential => {
         try {
             let finalCredential: VC;
-            const credentialPayload = await decryptInboxCredential(inboxCredential.credential);
-
-            if (inboxCredential.isSigned) {
+            const credentialPayload = inboxCredential.refreshId
+                ? undefined
+                : await decryptInboxCredential(inboxCredential.credential);
+
+            if (inboxCredential.refreshId) {
+                // A contact token authorizes delivery to the VP's DID. Never attach an unrelated
+                // contact profile's decryption key to that holder's refresh aggregate.
+                const boundProfile = await getProfileByDid(holderDid);
+                finalCredential = (
+                    await finalizeInboxRefresh({
+                        inboxId: inboxCredential.id,
+                        holderDid,
+                        holderProfile: boundProfile,
+                        domain: ctx.domain,
+                    })
+                ).credential;
+            } else if (inboxCredential.isSigned) {
                 // Credential is already signed
-                finalCredential = JSON.parse(credentialPayload) as VC;
+                finalCredential = JSON.parse(credentialPayload!) as VC;
             } else {
                 // Need to sign the credential using signing authority
-                const unsignedCredential = JSON.parse(credentialPayload) as UnsignedVC;
+                const unsignedCredential = JSON.parse(credentialPayload!) as UnsignedVC;
                 const inboxCredentialSigningAuthorityEndpoint =
                     (inboxCredential.signingAuthority?.endpoint as string) ?? undefined;
                 const inboxCredentialSigningAuthorityName =
@@ -676,25 +691,29 @@ async function handleInboxClaimPresentation(
                 ).credential as VC;
             }
 
-            // Avoid the seeded encryption wrapper, which adds the service as a recipient.
-            const deliveryLearnCard = await getEmptyLearnCard();
-            let encryptedDelivery: JWE;
-            try {
-                encryptedDelivery = await deliveryLearnCard.invoke.createDagJwe(finalCredential, [
-                    holderDid,
-                ]);
-                if (!encryptedDelivery.recipients?.length) {
-                    throw new Error('No supported delivery encryption recipients');
+            let encryptedDelivery: JWE | undefined;
+            if (!inboxCredential.refreshId) {
+                // Avoid the seeded encryption wrapper, which adds the service as a recipient.
+                const deliveryLearnCard = await getEmptyLearnCard();
+
+                try {
+                    encryptedDelivery = await deliveryLearnCard.invoke.createDagJwe(
+                        finalCredential,
+                        [holderDid]
+                    );
+                    if (!encryptedDelivery.recipients?.length) {
+                        throw new Error('No supported delivery encryption recipients');
+                    }
+                } catch (error) {
+                    deliveryEncryptionFailed = true;
+                    throw error;
                 }
-            } catch (error) {
-                deliveryEncryptionFailed = true;
-                throw error;
+                const finalized = await finalizeAndWipeInboxCredential(inboxCredential.id, {
+                    recipientDid: holderDid,
+                    credential: encryptedDelivery,
+                });
+                if (!finalized) throw new Error('Inbox credential is no longer pending');
             }
-            const finalized = await finalizeAndWipeInboxCredential(inboxCredential.id, {
-                recipientDid: holderDid,
-                credential: encryptedDelivery,
-            });
-            if (!finalized) throw new Error('Inbox credential is no longer pending');
 
             // Record the claim only after finalization succeeds so failed compare-and-swap
             // attempts cannot leave a misleading audit relationship behind.
@@ -708,7 +727,7 @@ async function handleInboxClaimPresentation(
 
             // Store credential and create boost relationship if this was a boost issuance
             const boostUri = inboxCredential.boostUri;
-            if (holderProfile && boostUri) {
+            if (!inboxCredential.refreshId && holderProfile && boostUri) {
                 try {
                     const boost = await getBoostByUri(boostUri);
                     const issuerProfile = await getProfileByDid(inboxCredential.issuerDid);
@@ -717,7 +736,7 @@ async function handleInboxClaimPresentation(
                         // Store the credential in the database
                         const credentialInstance = await storeCredential({
                             kind: 'issued-credential',
-                            credential: encryptedDelivery,
+                            credential: encryptedDelivery!,
                             statusEntries: getBitstringStatusListEntries(finalCredential),
                         });
 

package/src/services/delivery/adapters/postmark.adapter.test.ts

@@ -0,0 +1,54 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type { Notification } from '../delivery.service';
+
+const mocks = vi.hoisted(() => ({ send: vi.fn(), legacySend: vi.fn(), render: vi.fn() }));
+vi.mock('@environment', () => ({ environment: {} }));
+vi.mock('postmark', () => ({
+    ServerClient: class {
+        sendEmail = mocks.send;
+        sendEmailWithTemplate = mocks.legacySend;
+    },
+}));
+vi.mock('@learncard/email-templates', () => ({
+    resolveBranding: () => ({}),
+    renderEmail: mocks.render,
+}));
+import { PostmarkAdapter } from './postmark.adapter';
+
+const notification: Notification = {
+    contactMethod: { type: 'email', value: 'holder@example.com' },
+    templateId: 'credential-updated',
+    templateModel: { issuer: { name: 'School' }, credential: { name: 'Biology' } },
+};
+
+beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.render.mockResolvedValue({ html: '<p>Updated</p>', text: 'Updated', subject: 'Updated' });
+    mocks.send.mockResolvedValue({});
+});
+
+describe('update email provider attempts', () => {
+    it('sends the locally rendered update once', async () => {
+        await new PostmarkAdapter('test-key').send(notification);
+        expect(mocks.send).toHaveBeenCalledTimes(1);
+        expect(mocks.legacySend).not.toHaveBeenCalled();
+    });
+
+    it('does not try a legacy template after an ambiguous provider failure', async () => {
+        mocks.send.mockRejectedValueOnce(new Error('Acknowledgement lost'));
+        await expect(new PostmarkAdapter('test-key').send(notification)).rejects.toThrow(
+            'Acknowledgement lost'
+        );
+        expect(mocks.send).toHaveBeenCalledTimes(1);
+        expect(mocks.legacySend).not.toHaveBeenCalled();
+    });
+
+    it('fails without sending when the local update template cannot render', async () => {
+        mocks.render.mockRejectedValueOnce(new Error('Render failed'));
+        await expect(new PostmarkAdapter('test-key').send(notification)).rejects.toThrow(
+            'Render failed'
+        );
+        expect(mocks.send).not.toHaveBeenCalled();
+        expect(mocks.legacySend).not.toHaveBeenCalled();
+    });
+});

package/src/services/delivery/adapters/postmark.adapter.ts

@@ -41,6 +41,7 @@ const LOCAL_TEMPLATE_MAP: Record<string, TemplateId> = {
     'guardian-credential-approval': 'guardian-credential-approval',
     'guardian-email-otp': 'guardian-email-otp',
     'guardian-rejected-credential': 'guardian-rejected-credential',
+    'credential-updated': 'credential-updated',
 };
 
 export class PostmarkAdapter implements DeliveryService {
@@ -85,6 +86,8 @@ export class PostmarkAdapter implements DeliveryService {
                     `[PostmarkAdapter] Local render failed for "${notification.templateId}":`,
                     renderError
                 );
+                // This template is owned locally; there is no legacy provider alias.
+                if (notification.templateId === 'credential-updated') throw renderError;
             }
 
             if (rendered) {
@@ -104,6 +107,9 @@ export class PostmarkAdapter implements DeliveryService {
                         `[PostmarkAdapter] sendEmail API failed for "${notification.templateId}":`,
                         sendError
                     );
+                    // A lost provider acknowledgement may already have sent the email.
+                    // Do not bypass the refresh delivery claim with a second attempt.
+                    if (notification.templateId === 'credential-updated') throw sendError;
                 }
             }
         }
@@ -217,6 +223,12 @@ export class PostmarkAdapter implements DeliveryService {
                     recipient: model.recipient,
                 };
 
+            case 'credential-updated':
+                return {
+                    issuer: model.issuer,
+                    credential: model.credential,
+                };
+
             default:
                 return model as TemplateDataMap[TemplateId];
         }

package/src/services/registry/registry.factory.ts

@@ -7,7 +7,8 @@ export const getRegistryService = (): RegistryService => {
     if (
         environment.NODE_ENV === 'test' ||
         environment.TRUSTED_ISSUERS_WHITELIST ||
-        environment.IS_CI
+        environment.IS_CI ||
+        environment.IS_E2E_TEST
     ) {
         return new WhitelistAdapter();
     }