@learncard/network-brain-service 3.19.0 → 4.0.0

package/.env.example

@@ -1,94 +1,59 @@
-# Brain service environment
-# Copy to .env. Validation runs before database/client initialization.
-
-NODE_ENV=development
-PORT=3000
+# Brain service: copy to .env. These values are disposable local examples, not deploy secrets.
+# Public settings live in config/config.json and config/config.<stage>.json.
+# Precedence: schema defaults < base < stage < Lambda runtime bundle < non-empty real env.
+# CONFIG_STAGE=dev or production opts local/Docker/offline into a checked-in stage.
+# Without CONFIG_STAGE, keep using local env and schema defaults as before.
+# Lambda selects LAMBDA_STAGE; its bundle is brain-service/<stage>/runtime-secrets.
+# RUNTIME_SECRETS_ID is ignored outside Lambda. Keep GitHub fallbacks for rollback.
+CONFIG_STAGE=
+RUNTIME_SECRETS_ID=
+
+# Required credentials. Replace every local example before connecting to shared services.
 SEED=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 NEO4J_URI=bolt://localhost:7687
 NEO4J_USERNAME=neo4j
-NEO4J_PASSWORD=password
-DOMAIN_NAME=
-CLIENT_APP_DOMAIN_NAME=
-CLIENT_APP_PORT=3000
-LOGIN_PROVIDER_DID=
-
-APP_STORE_ADMIN_PROFILE_IDS=
-SKILL_FRAMEWORK_ADMIN_PROFILE_IDS=
-SKILL_FRAMEWORK_SEED_OWNER_PROFILE_ID=
-TRUSTED_BRAIN_SERVICES=
-TRUSTED_ISSUERS_WHITELIST=
-OIDC_TRUSTED_ISSUERS=
-OIDC_EXPECTED_AUDIENCE=
-
-AWS_REGION=
-NOTIFICATIONS_QUEUE_URL=
-INBOX_QUEUE_URL=
-INBOX_DEAD_LETTER_QUEUE_URL=
-# Set only for a local SQS emulator; production uses the AWS endpoint and IAM role.
-INBOX_QUEUE_ENDPOINT=
-NOTIFICATIONS_QUEUE_POLL_URL=
-NOTIFICATIONS_SERVICE_WEBHOOK_URL=
-NOTIFICATIONS_SERVICE_PORT=5100
-BRAIN_SERVICE_REGISTRY_URL=
-DCC_KNOWN_REGISTRIES_URL=
-OPENSALT_BASE_URL=
-OPENSALT_STAGING_BASE_URL=
-
-SKILLS_PROVIDER=
-SKILLS_PROVIDER_API_KEY=
-SKILLS_PROVIDER_BASE_URL=
-SKILL_EMBEDDING_GOOGLE_API_KEY=
-SKILL_EMBEDDING_GOOGLE_MODEL=
-SKILL_EMBEDDING_CACHE_TTL_SECONDS=
-SKILL_EMBEDDING_BATCH_SIZE=
-SKILL_EMBEDDING_BACKFILL_BATCH_SIZE=
-SKILL_EMBEDDING_BACKFILL_LOCK_TTL_SECONDS=
-SKILL_EMBEDDING_BACKFILL_PAGE_SIZE=
-SKILL_SEMANTIC_SEARCH_RATE_LIMIT_PER_MIN=
+NEO4J_PASSWORD=this-is-the-password
 
+# Optional integration credentials; all are bundle/fallback-only in Lambda.
 POSTMARK_API_KEY=
-POSTMARK_BRAND_NAME=
-POSTMARK_FROM_EMAIL=
+MESSAGEBIRD_AUTH_TOKEN=
+SENTRY_DSN=
+POSTHOG_API_KEY=
+SKILL_EMBEDDING_GOOGLE_API_KEY=
+SKILLS_PROVIDER_API_KEY=
 TWILIO_ACCOUNT_SID=
 TWILIO_AUTH_TOKEN=
-TWILIO_FROM_NUMBER=
-MESSAGEBIRD_AUTH_TOKEN=
-MESSAGEBIRD_ORIGINATOR=
-SMART_RESUME_ACCESS_KEY=
 SMART_RESUME_CLIENT_ID=
+SMART_RESUME_ACCESS_KEY=
 SMART_RESUME_CONTRACT_URI=
+APP_STORE_ADMIN_PROFILE_IDS=
+LOGIN_PROVIDER_DID=
+NOTIFICATIONS_SERVICE_WEBHOOK_URL=
+# Both checked-in stages enable credential refresh. Use independent, stable private secrets.
+CREDENTIAL_REFRESH_DIGEST_SECRET=local-only-replace-before-deploy-refresh-digest-secret
+SHARE_LINK_REQUEST_HASH_SECRET=local-only-replace-before-deploy-share-link-request-secret
 
-POSTHOG_API_KEY=
-POSTHOG_HOST=https://us.i.posthog.com
+# Local infrastructure. Explicit env overrides the selected stage; unset overrides you don't want.
+NODE_ENV=development
+IS_OFFLINE=true
+PORT=3000
 REDIS_HOST=
 REDIS_PORT=
-GIT_SHA=
-SENTRY_DSN=
-SENTRY_ENV=development
-
-BITSTRING_STATUS_LIST_SIZE=
-IS_OFFLINE=false
-IS_CI=false
-IS_E2E_TEST=false
-ENABLE_BENCH_ROUTES=false
-ENABLE_SEND_CREDENTIAL_TELEMETRY=false
-LC_PERF_LOG=false
-NEO4J_SKIP_INDICES=false
-SKILL_EMBEDDING_BACKFILL_ON_STARTUP=false
-SKILL_FRAMEWORKS_DEBUG=false
-SKIP_DIDKIT_NAPI=false
-SKIP_SKILL_FRAMEWORK_SEED=false
-TRACE_CONSOLE=true
-TRACE_JSON=false
-BITSTRING_STATUS_LIST_ALLOW_SMALL=false
-
-# Enable only after reviewing expired Universal Inbox audit history.
-INBOX_DELETE_EXPIRED_RECORDS=false
-
-# Managed credential refresh (LC-2117/LC-2135/LC-2136).
-# Set to 'true' to mount the authenticated GET /refresh/{refreshId} endpoints.
-# When enabled, CREDENTIAL_REFRESH_DIGEST_SECRET is required (validated at startup).
-CREDENTIAL_REFRESH_ENABLED=false
-CREDENTIAL_REFRESH_DIGEST_SECRET=
-# Hours during which repeat refresh notifications collapse into one unread record.
-CREDENTIAL_REFRESH_NOTIFICATION_WINDOW_HOURS=24
+AWS_REGION=
+NOTIFICATIONS_QUEUE_URL=
+INBOX_QUEUE_URL=
+INBOX_DEAD_LETTER_QUEUE_URL=
+INBOX_QUEUE_ENDPOINT=
+NOTIFICATIONS_QUEUE_POLL_URL=
+# Non-offline self-hosters must supply DOMAIN_NAME or select a registered CONFIG_STAGE.
+# For local DID resolution, an explicit override can be DOMAIN_NAME=localhost%3A4000.
+
+# App-store inline templates: LCA API signing authority that apps' credentials are signed through.
+SIGNING_AUTHORITY_ENDPOINT=http://localhost:5100/api
+
+# Optional sample-persona seeder (not Lambda runtime configuration).
+MONGO_URI=mongodb://localhost:27017/?replicaSet=rs0
+MONGO_DB_NAME=lca-api
+DEMO_PERSONA_SIGNING_AUTHORITY_ENDPOINT=http://localhost:5100/api
+DEMO_PERSONA_SA_SEED=
+# SENTRY_AUTH_TOKEN / SENTRY_ORG / SENTRY_PROJECT belong only in the build environment.

package/AGENTS.md

@@ -112,6 +112,44 @@ ConsentFlow is a consent management system where:
     3. The signing authority signs the credential and returns it
     4. The `issueCredentialWithSigningAuthority()` helper handles this flow
 - A common pattern is to get a signing authority with `getSigningAuthorityForUserByName(profile, endpoint, name)`
+- Known-recipient sends use the helper's `encrypt = true` default. Preserve its
+  `IssuedCredential` wrapper through storage so public status-list coordinates remain
+  available without decrypting the credential. Inbox finalization returns encrypted
+  deliveries; the network SDK decrypts them locally before returning VCs to the app.
+- Ordinary accepted inbox finalization signs and allocates status-list indices before
+  opening its bounded Neo4j transaction (30 seconds). Retries or a lost claim race may
+  leave indices unused; this is intentional to avoid signing while holding graph locks.
+  The transaction atomically commits escrow removal, encrypted recovery, credential/
+  boost/sent/received indexes, shared claim hooks, default claimed roles, and claim audit.
+  Notifications remain outside it; invalidate permission-related caches only after commit.
+  Failed graph writes leave the pending record retryable and concurrent claims cannot
+  duplicate acceptance.
+- CI runs `bunx nx run network-brain-service:test:inbox:e2e`, which includes
+  `test/credential-storage.neo4j.spec.ts` and `test/inbox.spec.ts`. Keep the storage
+  trust-boundary guard and finalization rollback/concurrency coverage in this CI-run
+  configuration, not only the locally invoked integration suite.
+- Unsigned inbox subjects are bound to the verified recipient before signing; supplied
+  subject IDs are replaced. Pre-signed subjects are not rewritten.
+- Ordinary unsigned finalization intentionally adds the issuer's profile DID as a reader
+  alongside the managed/app owner DID. This preserves the issuer's `did:key` access when
+  the signing authority uses an app `did:web` owner; it does not add the brain signer.
+- Three interoperable delivery paths intentionally request plaintext (`LC-2201`):
+    - `routes/workflows.ts`: boost claim-link exchanges return a VC inside a presentation
+      to wallets that may not support LearnCard JWE decryption.
+    - `routes/workflows.ts`: inbox claim-link exchanges have the same interoperability requirement.
+    - `routes/boosts.ts`: federated `/send` forwards to another network's inbox endpoint,
+      whose accepted encryption format is outside this server's control.
+- Managed refresh issuance is a separate existing boundary: refresh sends, inbox refresh
+  finalization, and refresh publication inspect the signed VC before encrypting it for
+  storage. LC-2201 does not change those refresh flows.
+  Its separate inbox finalization path does not use the ordinary-claim index transaction;
+  do not assume every refresh inbox finalization creates these network relationships.
+  Refresh inbox creation always persists `refreshId` alongside its `pending_holder`
+  aggregate; finalization dispatches those records to `finalizeInboxRefresh`, whose
+  accepted binding transitions the aggregate directly to `active`. Ordinary records
+  without `refreshId` do not own an `awaiting_claim` aggregate through this flow.
+  Normal `acceptCredential` also attempts activation after its already-received guard,
+  and the holder refresh endpoint can lazily reconcile acceptance.
 
 ### AutoBoosts
 
@@ -888,3 +926,17 @@ Tenant is resolved once per request in `createContext` via `resolveTenantFromReq
 4. Call `deliveryService.send()` from the route, passing `branding: ctx.tenant?.emailBranding`.
 
 See [Tenant-Branded Emails (architecture)](../../../docs/core-concepts/tenant-branded-emails.md) for the end-to-end flow and [Configure Tenant-Branded Emails](../../../docs/how-to-guides/configure-tenant-branded-emails.md) for operator-facing setup.
+
+### Attributed contract requests and event delivery
+
+- Integrator documentation lives in `docs/how-to-guides/consent-flow/brokered-referrals.md`, with the complete lifecycle sequence in `docs/core-concepts/consent-and-permissions/brokered-referral-lifecycle.md` and webhook fields in `docs/sdks/learncard-network/contract-requests-and-events.md`. Keep embedded `docs/snippets/contract-requests/` modules synchronized with `node scripts/check-docs-snippets.mjs --fix`; `tests/e2e/tests/docs-contract-requests.spec.ts` executes them against synthetic local services. The brain route `getConsentedDataForDid` is the SDK's `getConsentFlowDataForDid`; polling reconciles current state but cannot trigger learner claim/live sync. Scope grants never replace role or consent authorization.
+- Generic `REQUESTED_FOR` edges have `requestId`, `requestedBy`, optional `externalReferenceId`/`message`, and `requestedAt`. Exact pending retries are idempotent; conflicting or terminal requests do not reopen. Legacy edges have no request ID and retain legacy AI behavior.
+- Snapshot referral identity onto Terms and every related transaction, including issuance and maintenance. Do not infer historical correlation from the latest mutable request edge.
+- Append `ConsentFlowEvent` + per-recipient `ConsentFlowEventDelivery` in the same locked query as consent/request state changes. The contract audience lock serializes request decisions, consent and recipient changes.
+- `contract-events.helpers.ts` dispatches a bounded batch with leases; scheduler Lambda and Docker use the same worker. Contract notification callers opt in to typed permanent rejection errors (missing/disabled webhook or definitive HTTP 4xx, excluding 408/425/429); legacy boolean notification callers keep their behavior. Temporary failures and negative storage acknowledgements retry with exponential backoff (1 minute up to 1 hour), at most 12 claims or 24 hours from event creation. Count claims before external work so abandoned leases consume the budget. Terminal deliveries are delivered/skipped/rejected/failed; cleanup discards payload/message once all deliveries are terminal, retaining stable IDs and coarse failure reasons. Serialize fan-out completion on the event lock and recheck the lease before updating delivery state. Cleanup requires a running worker. Successful SQS enqueue completes the outbox delivery; its consumer acknowledges permanent contract rejection and leaves temporary failures to the queue policy. Consumers deduplicate `data.metadata.deliveryKey`.
+- Recheck current audience membership and consent/category permissions before outbox delivery and again in the SQS consumer. Nonaudience requesters receive only a decision, no transaction payload or Terms URI.
+- Referral management is separate from data access: owner/writers can inspect all requests; recipient-only callers can inspect only their own `requestedBy` requests, and targets their own incoming status. Enforce the role predicate in the Neo4j read query too, not just an earlier route check. Hidden status returns null like a missing request. Denial/cancellation fan-out is owner plus original requester, excluding the actor; suppress former broad queued deliveries. Consent data still reaches the current audience, but redact another referrer's `externalReferenceId` from metadata AND transaction.referral (and private message) unless the recipient is owner/writer or the original requester. Keep the full stored snapshot for learner-only history/exports.
+- Referral clients pass `expectedRequestId` through SDK/consent options. Check exact ID + pending status and contract expiry under the same contract lock as consent/re-consent writes, including after a route loaded a snapshot. Direct/legacy calls omit the ID and remain independent of invitation cancellation, but expired contracts cannot accept new consent. Only actual already-consented errors count as idempotent success in the app; other conflicts return to review.
+- Contract integration tests use `bun run test:integration -- test/contract-requests.spec.ts`; the default unit config excludes them.
+- From the repository root, `bun run test:referrals` wraps the referral and notification integration suites with Docker preflight, a synthetic seed, container reuse disabled, readable suite results, and temporary logs. `--full` includes consent/credential regressions. It uses the existing integration global setup and mock-instance database, never a configured live database; it does not start HTTP services or test the app.
+- Inline dispatch matches one event by its unique ID. Global cleanup uses indexed `cleanupPending=true`, removed on final cleanup; pending deliveries carry immutable `eventCreatedAt` and use separate indexed UNION branches for next attempt, age and attempts, deduplicated before claiming. The global worker runs a serialized one-time `indexed-outbox-v1` backfill for older retained bodies/pending deliveries. Drain old service writers before that backfill during rollout. Never replace this with a nullable event-ID OR or an every-tick history scan. Preserve the event lock and recheck pending deliveries after locking. The 12-attempt schedule normally exhausts after about six hours of uninterrupted failures; 24 hours is an additional age ceiling.

package/CHANGELOG.md

@@ -1,5 +1,152 @@
 # @learncard/network-brain-service
 
+## 4.0.0
+
+### Major Changes
+
+- [#1647](https://github.com/learningeconomy/LearnCard/pull/1647) [`544d50fddf3fd93a37e4f87fd741038168f94e17`](https://github.com/learningeconomy/LearnCard/commit/544d50fddf3fd93a37e4f87fd741038168f94e17) Thanks [@smurflo2](https://github.com/smurflo2)! - fix: [LC-2201] Encrypt known-recipient server-side credential issuance and decrypt finalized inbox deliveries in the SDK. Raw inbox finalization now returns JWEs instead of plaintext VCs; deploy the updated SDK with the backend.
+
+### Minor Changes
+
+- [#1632](https://github.com/learningeconomy/LearnCard/pull/1632) [`6209da80c52ac056a7644dab14669192740c9dad`](https://github.com/learningeconomy/LearnCard/commit/6209da80c52ac056a7644dab14669192740c9dad) Thanks [@goblincore](https://github.com/goblincore)! - Add explicit consent contract data recipients and audience version acknowledgements. Enforce current consent status, expiry, category sharing, and recipient membership on consented data reads. Recipient additions freeze after first consent; removals immediately revoke API access and invalidate stale consent/update/sync acknowledgements.
+
+    Update existing app consent paths to review the current data audience, encrypt for all recipients, and cache copies by the full audience. Background synchronization reloads recipients and acknowledges the current version.
+
+- [#1634](https://github.com/learningeconomy/LearnCard/pull/1634) [`5890451789b18afee45dc5ecbab3fa30aa90f085`](https://github.com/learningeconomy/LearnCard/commit/5890451789b18afee45dc5ecbab3fa30aa90f085) Thanks [@goblincore](https://github.com/goblincore)! - Add attributed generic contract requests, target-only denial, retained cancellation history, and optional referral identity on consent history and exports. Preserve legacy AI request payloads and owner-only consent behavior.
+
+    Persist correlated notification intents with consent mutations and retry via a leased Lambda/Docker worker. Fan out to the owner and current data recipients; give a requester outside that audience only a minimal decision. Recheck audience membership and current consent permissions before delivery, including queued notifications, and expose stable event and delivery IDs for downstream deduplication.
+
+    Keep app request hooks and legacy AI component props aligned with the shared request status type, including retained generic cancellations.
+
+- [#1429](https://github.com/learningeconomy/LearnCard/pull/1429) [`1387cd0a08fa6b0a706c86a5a0376b6c7d706856`](https://github.com/learningeconomy/LearnCard/commit/1387cd0a08fa6b0a706c86a5a0376b6c7d706856) Thanks [@Custard7](https://github.com/Custard7)! - Make Partner Connect apps zero-config. Apps can send credentials from inline templates (`sendCredential({ alias, template, templateData })`) and request scoped consent (`requestConsent({ read, write, reason })`) without creating boosts or contracts in LearnCard first; the network creates and versions them on first use. New `@learncard/partner-connect-core` package holds the shared template compiler, validator, and manifest helpers.
+
+    Mock mode now captures an app manifest and offers a one-click publish link (`getCapturedManifest()`, `getPublishUrl()`), and `mock: 'auto'` also activates inside AI app-builder editor previews (Lovable, Bolt, v0, Replit) while never mocking on published app addresses. Adds template validation and preview, template issuance status and recipient queries, and a typed `PartnerConnectError`.
+
+    LearnCard gains a publish-from-link page with live preview and a consent designer, a simple app dashboard with manifest version diffs and one-step "Apply & Ship", and network routes plus plugin methods to submit, compare, and apply manifest versions. The publish page asks for the real address when an app was captured on a local or app-builder preview address.
+
+    App captures are additive: submitting a manifest merges it into the latest version (`mergeCapturedManifests`), so features a run didn't exercise are kept rather than reported as removed.
+
+    Practice mode gets a redesigned look: frosted-glass notices with clear icons and plain-language copy (at most three on screen, one on phones), and a "Practice mode" panel that lists the LearnCard features your app uses in plain words with a one-tap Publish button. Both follow the system light/dark setting and respect reduced motion.
+
+    Practice mode now remembers a separate identity for each app, so apps sharing a local address publish separately. Start over from the panel or with `resetPracticeMode()` to clear just that app's practice history. App icons are picked more accurately and can travel with the publish link as a small image, with a size limit to keep links manageable.
+
+    Calling `requestConsent()` without saying what you need now shows an amber "Choose what to ask for" notice in practice mode, and the panel marks it "Not set up yet", instead of pretending it will work when published. The publish page opens the consent setup pre-filled from what your app uses, reloads the preview once it's enabled, and checks with you before submitting without it.
+
+- [#1429](https://github.com/learningeconomy/LearnCard/pull/1429) [`1387cd0a08fa6b0a706c86a5a0376b6c7d706856`](https://github.com/learningeconomy/LearnCard/commit/1387cd0a08fa6b0a706c86a5a0376b6c7d706856) Thanks [@Custard7](https://github.com/Custard7)! - Changes to a live App Store app now go through review. Listing edits and newly applied capabilities on a `LISTED` app are held as a pending update (`pending_update` on owner and admin listing responses) and only take effect once an admin approves them. New routes and plugin methods: `submitAppStoreListingUpdate`, `withdrawAppStoreListingUpdate`, `discardAppStoreListingUpdate`, and `adminReviewListingUpdate`; `adminGetAllListings` accepts `pendingUpdatesOnly`. `applyManifestVersion` returns `applied: false, pendingReview: true` for live apps.
+
+    The publish page and listing editor now show apps that are in review or live with their saved details, let developers withdraw a submission to make changes, and submit updates to live apps. The admin dashboard has an Updates view for reviewing them.
+
+- [#1651](https://github.com/learningeconomy/LearnCard/pull/1651) [`267cf40291b3a63caf178857be0e57feaf5e0948`](https://github.com/learningeconomy/LearnCard/commit/267cf40291b3a63caf178857be0e57feaf5e0948) Thanks [@goblincore](https://github.com/goblincore)! - Publish Resume Builder PDFs through version-bound encrypted managed attachments. Add owner chunk staging/cleanup and guarded recipient retrieval, preserve atomic share lifecycle and passcode protection, and keep original selected credential contexts and proofs intact inside LER-RS records.
+
+    LER-RS `verifications` now uses JSON-LD `@json` so embedded original credentials retain their contexts and proofs. This changes canonicalization for newly issued LER-RS credentials; it does not rewrite or re-sign embedded source credentials.
+
+### Patch Changes
+
+- [#1670](https://github.com/learningeconomy/LearnCard/pull/1670) [`7656a57d30c6d80b8a25a8bb14bcd3b08b3648c2`](https://github.com/learningeconomy/LearnCard/commit/7656a57d30c6d80b8a25a8bb14bcd3b08b3648c2) Thanks [@Custard7](https://github.com/Custard7)! - Adopt the shared @learncard/service-config layered configuration model: checked-in non-secret per-stage config files (config/config.<stage>.json), lazy Lambda bootstrap that applies stage config and loads the optional runtime secrets bundle before importing the application, a CONFIG_STAGE-keyed Docker/local entrypoint, and a serverless function-environment fallback helper scoped by an IAM runtime-secrets read grant. Real environment variables always win and the GitHub-environment fallbacks remain in effect until each stage has a complete bundle.
+
+- [#979](https://github.com/learningeconomy/LearnCard/pull/979) [`a55332b1652567bc7f3d60064a446365c134cf24`](https://github.com/learningeconomy/LearnCard/commit/a55332b1652567bc7f3d60064a446365c134cf24) Thanks [@github-actions](https://github.com/apps/github-actions)! - Export complete mutually exclusive credential-refresh publication schemas for generated clients. Regenerate the Python SDK from pinned, offline local inputs with omission-preserving models and UTC Z-only activity date filters; verify prepared requests against the unchanged server contracts.
+
+- [#1644](https://github.com/learningeconomy/LearnCard/pull/1644) [`37a3db8ff98a35c8e9e140569a693c9e0ed00165`](https://github.com/learningeconomy/LearnCard/commit/37a3db8ff98a35c8e9e140569a693c9e0ed00165) Thanks [@smurflo2](https://github.com/smurflo2)! - fix: [LC-2225] Separate managed organizations from child consent and sharing restrictions. Preserve guardian approval history and explicitly typed children's protections, including legacy records with a service flag. Keep organization creation supported while rejecting service flags on Family and explicitly typed child creation paths.
+
+    Keep guardian-gated consent writes aligned with read and share policy for legacy service-flagged children, and prevent those children from changing their own profile type to evade protection.
+
+- [#1429](https://github.com/learningeconomy/LearnCard/pull/1429) [`1387cd0a08fa6b0a706c86a5a0376b6c7d706856`](https://github.com/learningeconomy/LearnCard/commit/1387cd0a08fa6b0a706c86a5a0376b6c7d706856) Thanks [@Custard7](https://github.com/Custard7)! - Add a trusted-service `ensureManagedSigningAuthority` route (`POST /signing-authority/managed`) that returns or creates a named signing authority for an owner DID through the standard encrypted-seed path. Brain service now provisions app signing authorities through this route instead of writing plaintext seeds to the LCA API database.
+
+- [#1637](https://github.com/learningeconomy/LearnCard/pull/1637) [`ec321885908bab179acac7fec910bf61c42deb5f`](https://github.com/learningeconomy/LearnCard/commit/ec321885908bab179acac7fec910bf61c42deb5f) Thanks [@goblincore](https://github.com/goblincore)! - Add gated referral invitations with attributed cards, audience and permission review, confirmed decline, and pending invitation recovery after alert dismissal. Require both tenant configuration and the enableContractRequests rollout flag; preserve existing AI and owner-only consent flows. Localize the experience in English, Spanish, French, and Arabic.
+
+    Show receiving organizations in consent and connected-app details and recheck current referral state before consent submission. Include a signed HTTP outcome acceptance lab and integration walkthrough.
+
+    Keep the receiving organizations visible in detailed privacy settings and connected-app access editing, while preserving the existing owner-only layout.
+
+    Bind referral acceptance to the reviewed request ID under the contract lock, reject expired contracts on consent/re-consent, and keep invitation conflicts in the review screen. Stop polling terminal invitations, localize permission summaries, retry failed dismissals, and support host-reachable webhook capture from Docker.
+
+    Document the complete referral, auto-boost, outcome, claim, synchronization and webhook lifecycle. Add tested integrator snippets for recipient contracts, signing authority setup, scoped runtime tokens and polling recovery, including the client activity required for live sharing.
+
+    Refine referral cards and review panels with compact typography, grouped audience and permission details, accessible actions, and lighter privacy settings. Keep invitation and consent behavior unchanged.
+
+- [#1670](https://github.com/learningeconomy/LearnCard/pull/1670) [`7656a57d30c6d80b8a25a8bb14bcd3b08b3648c2`](https://github.com/learningeconomy/LearnCard/commit/7656a57d30c6d80b8a25a8bb14bcd3b08b3648c2) Thanks [@Custard7](https://github.com/Custard7)! - Select backend stage files by tenant as well as stage. `CONFIG_TENANT=scouts` loads `config.scouts.<stage>.json` (generated from the live ScoutPass Lambdas), so ScoutPass deployments no longer inherit LearnCard domains, trust settings or seed-encryption flags; a named tenant without a stage file fails closed. `ESCROW_ENCLAVE_MODE` is now forwarded in runtime-secrets bundle mode too.
+
+- [#1644](https://github.com/learningeconomy/LearnCard/pull/1644) [`37a3db8ff98a35c8e9e140569a693c9e0ed00165`](https://github.com/learningeconomy/LearnCard/commit/37a3db8ff98a35c8e9e140569a693c9e0ed00165) Thanks [@smurflo2](https://github.com/smurflo2)! - Enable share-link view tracking for persisted service profiles without requiring a date of birth, including managed organizations. Apply the exemption during creation and transactional view-receipt checks, and show eligible service-profile view statistics in Privacy & Data. Keep child and personal-account age protections, link expiry behavior, and other privacy gates unchanged.
+
+    Preserve the 30-day default expiry for managed service profiles with adult birthdates. Refresh older resolved service tracking restrictions on an explicit owner edit only after a locked service-classification check, preserving stored expiry and the eligibility limits of replayed or recovered reservations.
+
+- Updated dependencies [[`6209da80c52ac056a7644dab14669192740c9dad`](https://github.com/learningeconomy/LearnCard/commit/6209da80c52ac056a7644dab14669192740c9dad), [`5890451789b18afee45dc5ecbab3fa30aa90f085`](https://github.com/learningeconomy/LearnCard/commit/5890451789b18afee45dc5ecbab3fa30aa90f085), [`23c30e68ca4fc5feb70ab3a5660aae71e486d63e`](https://github.com/learningeconomy/LearnCard/commit/23c30e68ca4fc5feb70ab3a5660aae71e486d63e), [`aaeca3dad4a899a4ce7e96009ba211b4c27af7a2`](https://github.com/learningeconomy/LearnCard/commit/aaeca3dad4a899a4ce7e96009ba211b4c27af7a2), [`1387cd0a08fa6b0a706c86a5a0376b6c7d706856`](https://github.com/learningeconomy/LearnCard/commit/1387cd0a08fa6b0a706c86a5a0376b6c7d706856), [`d7ca528898d988c65f0dc7084cfdcd41767648c5`](https://github.com/learningeconomy/LearnCard/commit/d7ca528898d988c65f0dc7084cfdcd41767648c5), [`d7ca528898d988c65f0dc7084cfdcd41767648c5`](https://github.com/learningeconomy/LearnCard/commit/d7ca528898d988c65f0dc7084cfdcd41767648c5), [`8f3bc66ab3d3e5e1edb3fbf5f362025875a914ba`](https://github.com/learningeconomy/LearnCard/commit/8f3bc66ab3d3e5e1edb3fbf5f362025875a914ba), [`1387cd0a08fa6b0a706c86a5a0376b6c7d706856`](https://github.com/learningeconomy/LearnCard/commit/1387cd0a08fa6b0a706c86a5a0376b6c7d706856), [`267cf40291b3a63caf178857be0e57feaf5e0948`](https://github.com/learningeconomy/LearnCard/commit/267cf40291b3a63caf178857be0e57feaf5e0948), [`7656a57d30c6d80b8a25a8bb14bcd3b08b3648c2`](https://github.com/learningeconomy/LearnCard/commit/7656a57d30c6d80b8a25a8bb14bcd3b08b3648c2), [`c78c982f9f4911f1ca2973380f19d80db775e012`](https://github.com/learningeconomy/LearnCard/commit/c78c982f9f4911f1ca2973380f19d80db775e012), [`590adf48867d6c6fd504e66a11c9827d5102122d`](https://github.com/learningeconomy/LearnCard/commit/590adf48867d6c6fd504e66a11c9827d5102122d)]:
+    - @learncard/types@5.23.0
+    - @learncard/credential-library@2.1.0
+    - @learncard/partner-connect-core@0.2.0
+    - @learncard/email-templates@1.2.1
+    - @learncard/service-config@0.1.1
+    - @learncard/didkit-plugin@1.10.3
+    - @learncard/core@9.4.38
+    - @learncard/helpers@1.6.2
+    - @learncard/did-web-plugin@1.1.38
+    - @learncard/didkey-plugin@1.1.38
+    - @learncard/didkit-plugin-node@0.3.3
+    - @learncard/encryption-plugin@1.1.38
+    - @learncard/learn-card-plugin@1.2.38
+    - @learncard/vc-plugin@1.6.4
+    - @learncard/vc-templates-plugin@1.1.38
+    - @learncard/crypto-plugin@1.1.38
+    - @learncard/dynamic-loader-plugin@1.1.38
+    - @learncard/expiration-plugin@1.2.38
+
+## Unreleased
+
+### Patch Changes
+
+- LC-2201: Encrypt signing-authority credentials for direct local sends, verified-email
+  inbox delivery, and accepted inbox finalization. Preserve public status coordinates
+  for revocation without decrypting payloads. Ordinary finalized inbox credentials are
+  indexed for their recipient and returned as encrypted deliveries for client-side decryption.
+  Interoperable claim exchanges and federated sends intentionally remain plaintext.
+- LC-2201: Finalize ordinary inbox claims and their network indexes, permission hooks,
+  default claimed role, and claim audit in one transaction. Failed graph writes keep
+  pending escrow intact so retry can complete the delivery without partial permissions
+  or orphaned indexes; concurrent claims produce one accepted delivery.
+- LC-2201: Bound ordinary inbox finalization's Neo4j transaction to 30 seconds.
+  Signing stays outside the transaction; failed writes and lost claim races may leave
+  unused status-list indices rather than hold graph locks across external signing.
+- LC-2201: Bind unsigned inbox subject IDs to the verified recipient before signing,
+  replacing template-supplied IDs. Pre-signed credentials retain their signed subjects.
+
+## 3.19.1
+
+### Patch Changes
+
+- [#1607](https://github.com/learningeconomy/LearnCard/pull/1607) [`b184f5552abf37a11468d435e5cea07fc35e1993`](https://github.com/learningeconomy/LearnCard/commit/b184f5552abf37a11468d435e5cea07fc35e1993) Thanks [@goblincore](https://github.com/goblincore)! - Make `acceptPresentation` idempotent so retries of a saved collection do not create duplicate relationships. New or replacement share-link passcodes require at least eight characters; existing shorter passcodes remain valid for recipients. Public share resolution can now return `try_later` when passcode verification is unavailable or throttled.
+
+- [#1624](https://github.com/learningeconomy/LearnCard/pull/1624) [`7e5c2b9ce9fabbd5635cf17a2c6eea5c3ce692fa`](https://github.com/learningeconomy/LearnCard/commit/7e5c2b9ce9fabbd5635cf17a2c6eea5c3ce692fa) Thanks [@Custard7](https://github.com/Custard7)! - fix: Stop treating service profiles as child accounts and fix managed-child claim email template
+
+- [#1529](https://github.com/learningeconomy/LearnCard/pull/1529) [`0e262737aafb8248e88e05039c83a3f30be6750f`](https://github.com/learningeconomy/LearnCard/commit/0e262737aafb8248e88e05039c83a3f30be6750f) Thanks [@Custard7](https://github.com/Custard7)! - SSS prod hardening: confirmed recovery enrollment, lost-login identity rebind, and an isolated email relay.
+
+    - Recovery methods now carry `confirmedAt` and must be proven before they count (email confirmation code, phrase challenge words, backup re-decrypt, passkey round trip). New SSS accounts are `active` immediately; web3auth migrations stay `provisional` until a method is confirmed.
+    - New recovery-session flow lets a user whose sign-in identity is gone recover via a verified personal email and bind a new sign-in.
+    - Email recovery shares are encrypted on the client to an isolated relay's public key; `lca-api` never sees plaintext. Provider tokens move from query strings to the `X-Auth-Token` header.
+    - Sensitive key routes require a single-use DID challenge; key records are keyed by immutable provider ID.
+    - `recovery-key` email template now requires `confirmationCode`.
+    - Auth-share initialization requires the provider uniqueness index before inserting, preventing competing first writes from creating duplicate accounts. Existing records with missing or BSON-null auth material retain atomic update protection.
+    - Automatic stale-key cleanup preserves unresolved pending shares for delayed commits; explicit device forgetting still removes them. Custom SSS storage adapters now implement `deleteDeviceShare(id?)` to remove only the selected share and its version.
+
+- [#1614](https://github.com/learningeconomy/LearnCard/pull/1614) [`ae10525fbd0ef284aabe1b03d12db147a1922f2c`](https://github.com/learningeconomy/LearnCard/commit/ae10525fbd0ef284aabe1b03d12db147a1922f2c) Thanks [@smurflo2](https://github.com/smurflo2)! - feat: [LC-2191] Replace Demo School with standards-pure sample personas, including plain OBv3 ConsentFlow issuance without proprietary `boostId` fields.
+
+- Updated dependencies [[`4b83aa9ee802f0d7a54adc5f053a7376fa103cdd`](https://github.com/learningeconomy/LearnCard/commit/4b83aa9ee802f0d7a54adc5f053a7376fa103cdd), [`2ebda517e9468476f22d3ae3b4ebddf67e8aca78`](https://github.com/learningeconomy/LearnCard/commit/2ebda517e9468476f22d3ae3b4ebddf67e8aca78), [`0e9dd47f4451d776ad1787d0a35dbd54141b9fe3`](https://github.com/learningeconomy/LearnCard/commit/0e9dd47f4451d776ad1787d0a35dbd54141b9fe3), [`b184f5552abf37a11468d435e5cea07fc35e1993`](https://github.com/learningeconomy/LearnCard/commit/b184f5552abf37a11468d435e5cea07fc35e1993), [`0e262737aafb8248e88e05039c83a3f30be6750f`](https://github.com/learningeconomy/LearnCard/commit/0e262737aafb8248e88e05039c83a3f30be6750f), [`ae10525fbd0ef284aabe1b03d12db147a1922f2c`](https://github.com/learningeconomy/LearnCard/commit/ae10525fbd0ef284aabe1b03d12db147a1922f2c), [`d436c39e00994e6d8c77e7b94985a51fe1f42adb`](https://github.com/learningeconomy/LearnCard/commit/d436c39e00994e6d8c77e7b94985a51fe1f42adb)]:
+    - @learncard/types@5.22.0
+    - @learncard/credential-library@2.0.5
+    - @learncard/email-templates@1.2.0
+    - @learncard/helpers@1.6.1
+    - @learncard/core@9.4.37
+    - @learncard/did-web-plugin@1.1.37
+    - @learncard/didkey-plugin@1.1.37
+    - @learncard/didkit-plugin@1.10.2
+    - @learncard/didkit-plugin-node@0.3.2
+    - @learncard/encryption-plugin@1.1.37
+    - @learncard/learn-card-plugin@1.2.37
+    - @learncard/vc-plugin@1.6.3
+    - @learncard/vc-templates-plugin@1.1.37
+    - @learncard/crypto-plugin@1.1.37
+    - @learncard/dynamic-loader-plugin@1.1.37
+    - @learncard/expiration-plugin@1.2.37
+
 ## 3.19.0
 
 ### Minor Changes

package/README.md

@@ -9,10 +9,10 @@ This service exposes the LearnCard Network API and local Neo4j-backed skills flo
 - `termsUri`, `contractUri`, `status` and `terms` identify the current grant and its permissions.
 - `createdAt` is the original grant time when known. `date` is the latest consent update time. No historical timestamp is invented.
 - `contractUpdatedAt` identifies the current contract revision; `contractExpiresAt` and `reasonForAccessing` report existing contract metadata. These fields do not imply acceptance of a new privacy notice.
-- `guardian.required` uses LearnCard's existing manager-based guardian rules, including authorized role-based managers. Persisted guardian approval history keeps this requirement after manager removal.
+- `guardian.required` uses LearnCard's existing manager-based guardian rules for non-service profiles and explicitly typed children, including authorized role-based managers. An explicit `child` type takes precedence over a legacy service flag. A service profile's managers are otherwise administrators, not guardians. Explicit approval metadata and persisted guardian approval history still require approval, including after manager removal or a change to service-profile status.
 - `guardian.approved` requires a recorded approval for the current contract revision and a guardian who is still an authorized manager. Approval is server-recorded alongside the exact consent terms and transaction; it is not accepted from client-supplied terms. Raw approval presentations are not retained.
 
-Existing adult grants remain eligible without new guardian or privacy-notice attestations. Existing managed-profile grants without recorded approval return `required: true, approved: false` and need a guardian-confirmed consent update. Consumers must enforce that distinction before AI processing; receipt metadata alone is not an authorization check.
+Existing adult and managed service-profile grants remain eligible without new guardian or privacy-notice attestations unless they have guardian approval history. Existing managed non-service-profile grants without recorded approval return `required: true, approved: false` and need a guardian-confirmed consent update. Consumers must enforce that distinction before AI processing; receipt metadata alone is not an authorization check.
 
 Removing all managers is not an adulthood transition. Guardian approval history survives withdrawal, so withdrawing and consenting again does **not** remove the requirement. Recovery first requires current manager authority: the existing verified-contact / `inbox.claimPendingGuardianLinks` flow can relink a guardian only when their verified email matches an eligible guardian-approved inbox credential for that child. Without that evidence, account/guardian-link recovery is a prerequisite; there is no generic self-service existing-child manager restoration or adult-conversion endpoint here. After authority is restored, obtain fresh approval to update live terms or reconsent withdrawn terms.
 
@@ -20,6 +20,13 @@ Guardian presentations retain a maximum five-minute signed lifetime. The backend
 
 Deploy this producer before an AI Passport consumer that requires the new guardian metadata.
 
+## Managed service profiles and children
+
+`createManagedProfile` supports service profiles for developer/org onboarding and admin tools. It rejects `isServiceProfile: true` when the authenticated manager has a persisted parent Boost with category `Family`, or the requested profile has type `child`. Family child creation cannot use that flag to bypass guardian checks; other managed org creation remains supported.
+
+Share-link policy exempts persisted service owners from management and birthdate restrictions **for tracking only**, in both preflight and the transactional recheck. An explicit `child` type always keeps child protections, even if a legacy record also has the service flag; the service flag is age-exempt, not an assertion of adulthood. Personal profiles with missing or malformed birthdates and managed non-service owners remain restricted. Default expiry still uses persisted age and management: managed service profiles keep a 30-day default, including those with an adult birthdate. Explicit null or date expiry, AI gates and other privacy settings are unchanged. Existing links retain their stored policy until an explicit edit rechecks current eligibility; this also refreshes older resolved service snapshots, without changing stored expiry. Reserved and freshly checked eligibility must both permit tracking, so a stale replay or recovery cannot broaden a restricted reservation. Creating a fresh link also applies the exemption.
+Guardian-gated writes and consent metadata likewise exempt only service profiles that are not explicitly typed as children. A persisted service-flagged child cannot change its type through profile updates.
+
 ## Skill framework seeding
 
 - **Auto-bootstrap**: on local/dev startup, if no `SkillFramework` nodes exist, the service seeds a default public set owned by the `network-seed` profile.
@@ -29,6 +36,48 @@ Deploy this producer before an AI Passport consumer that requires the new guardi
 - **Default environment**: if you omit the stage, the command defaults to `local` and prints a note.
 - **Production safety**: the manual seed command still refuses to run in production unless `--force` is provided.
 
+## Sample persona seeding
+
+Sample personas are ordered credential-library bundles published as idempotent
+consent-flow contracts. The seeder uses every target value from
+`services/learn-card-network/brain-service/.env`; verify them before running it.
+Do not overwrite an existing `.env` or assume it points to local services.
+
+For the local LearnCard App Compose stack, use explicit host-side values:
+
+```dotenv
+NEO4J_URI=bolt://localhost:7687
+NEO4J_USERNAME=neo4j
+NEO4J_PASSWORD=this-is-the-password
+MONGO_URI=mongodb://localhost:27017/?replicaSet=rs0
+MONGO_DB_NAME=lca-api
+REDIS_HOST=localhost
+REDIS_PORT=6379
+DOMAIN_NAME=localhost%3A4000
+DEMO_PERSONA_SIGNING_AUTHORITY_ENDPOINT=http://localhost:5100/api
+# Disposable local-only seed. Never reuse this value in a shared environment.
+DEMO_PERSONA_SA_SEED=dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd
+```
+
+Start the stack, then publish the bundle from `apps/learn-card-app`:
+
+```bash
+bun run seed:demo-persona student
+```
+
+Staging and production require their own secret 64-character hexadecimal
+`DEMO_PERSONA_SA_SEED`, the matching LCA API endpoint, and explicit Neo4j, MongoDB,
+Redis, and domain settings. Deploy the brain service first, run the seeder against
+the intended environment, verify the printed contract URI, and only then deploy app
+configuration that references it.
+
+The root seed deterministically derives a distinct signing identity for every
+configured sample issuer. The command updates issuer profiles, unsigned credential
+templates, and auto-boost relationships in place, then prints the stable contract URI
+to record in that tenant's `features.samplePersonas`. Running it again publishes
+credential-library content changes without duplicating profiles, Boosts, signing
+authorities, or contracts.
+
 ## Notes
 
 - The default fixture is idempotent by framework and skill ID, so running the seed command multiple times does not duplicate data.

package/bootstrapLambda.test.ts

@@ -0,0 +1,72 @@
+import type { APIGatewayProxyEventV2, Context } from 'aws-lambda';
+import { beforeEach, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({ bootstrap: vi.fn(), getApp: vi.fn(), handler: vi.fn() }));
+
+vi.mock('@learncard/service-config', () => ({ bootstrapLambda: mocks.bootstrap }));
+vi.mock('./src/config/stageConfig', () => ({ base: {}, stages: { dev: {}, production: {} } }));
+
+const LAMBDA_APP_HANDLERS = [
+    'trpcHandler',
+    'openApiHandler',
+    'swaggerUiHandler',
+    'skillsViewerHandler',
+    'statusListsHandler',
+    'credentialRefreshHandler',
+    'inboxQueueWorker',
+    'inboxQueueDispatcher',
+    'inboxDeadLetterWorker',
+    'notificationsWorker',
+    'inboxMaintenanceHandler',
+] as const;
+
+vi.mock('./lambdaApp', () =>
+    Object.fromEntries(LAMBDA_APP_HANDLERS.map(name => [name, mocks.handler]))
+);
+
+beforeEach(() => {
+    vi.resetModules();
+    vi.clearAllMocks();
+    mocks.bootstrap.mockReturnValue(mocks.getApp);
+    mocks.handler.mockResolvedValue({ statusCode: 200 });
+});
+
+it('bootstraps the API once with checked-in stage config', async () => {
+    vi.stubEnv('AWS_LAMBDA_FUNCTION_NAME', 'lcn-brain-service-dev-trpc');
+    vi.stubEnv('LAMBDA_STAGE', 'dev');
+    await import('./lambda');
+    expect(mocks.bootstrap).toHaveBeenCalledTimes(1);
+    expect(mocks.bootstrap).toHaveBeenCalledWith({
+        base: {},
+        stages: { dev: {}, production: {} },
+        stage: 'dev',
+        importApp: expect.any(Function),
+    });
+    vi.unstubAllEnvs();
+});
+
+it('uses CONFIG_STAGE outside Lambda rather than LAMBDA_STAGE', async () => {
+    vi.stubEnv('AWS_LAMBDA_FUNCTION_NAME', '');
+    vi.stubEnv('LAMBDA_STAGE', 'production');
+    vi.stubEnv('CONFIG_STAGE', 'dev');
+    await import('./lambda');
+    expect(mocks.bootstrap).toHaveBeenCalledWith(expect.objectContaining({ stage: 'dev' }));
+    vi.unstubAllEnvs();
+});
+
+it('forwards every handler through its bootstrap accessor', async () => {
+    mocks.getApp.mockResolvedValue(
+        Object.fromEntries(LAMBDA_APP_HANDLERS.map(name => [name, mocks.handler]))
+    );
+    const lambda = await import('./lambda');
+    const event = {} as APIGatewayProxyEventV2;
+    const context = {} as Context;
+    const callback = vi.fn();
+    for (const name of LAMBDA_APP_HANDLERS) {
+        await (lambda[name] as (...args: unknown[]) => Promise<unknown>)(event, context, callback);
+    }
+    expect(mocks.bootstrap).toHaveBeenCalledTimes(1);
+    expect(mocks.getApp).toHaveBeenCalledTimes(LAMBDA_APP_HANDLERS.length);
+    expect(mocks.handler).toHaveBeenCalledTimes(LAMBDA_APP_HANDLERS.length);
+    expect(mocks.handler).toHaveBeenCalledWith(event, context, callback);
+});

package/config/config.dev.json

@@ -0,0 +1,29 @@
+{
+    "CLIENT_APP_DOMAIN_NAME": "learncard.app",
+    "CREDENTIAL_REFRESH_ENABLED": "true",
+    "CREDENTIAL_REFRESH_NOTIFICATION_WINDOW_HOURS": "12",
+    "DOMAIN_NAME": "staging.network.learncard.com",
+    "INBOX_BATCH_ITEMS_PER_HOUR": "10000",
+    "INBOX_DELETE_EXPIRED_RECORDS": "false",
+    "MESSAGEBIRD_ORIGINATOR": "+12077447198",
+    "OIDC_EXPECTED_AUDIENCE": "learncard",
+    "OIDC_TRUSTED_ISSUERS": "https://securetoken.google.com/learncard",
+    "POSTMARK_FROM_EMAIL": "inbox@learncard.com",
+    "SENTRY_ENV": "lcn-staging",
+    "SHARE_LINK_MAINTENANCE_ALLOW_INSECURE_LOOPBACK": "false",
+    "SHARE_LINK_MAINTENANCE_AUDIENCE": "did:web:staging.cloud.learncard.com",
+    "SHARE_LINK_MAINTENANCE_BUDGET_MS": "60000",
+    "SHARE_LINK_MAINTENANCE_CLAIMANT": "brain-share-link-maintenance",
+    "SHARE_LINK_MAINTENANCE_CLAIM_MS": "300000",
+    "SHARE_LINK_MAINTENANCE_CLEANUP_LIMIT": "25",
+    "SHARE_LINK_MAINTENANCE_FINALIZE_RESERVE_MS": "5000",
+    "SHARE_LINK_MAINTENANCE_GRAPH_TIMEOUT_MS": "15000",
+    "SHARE_LINK_MAINTENANCE_INTERVAL_MS": "300000",
+    "SHARE_LINK_MAINTENANCE_LEASE_MS": "120000",
+    "SHARE_LINK_MAINTENANCE_NAMESPACE": "learncard",
+    "SHARE_LINK_MAINTENANCE_ORIGIN": "https://staging.cloud.learncard.com",
+    "SHARE_LINK_MAINTENANCE_RECOVERY_LIMIT": "25",
+    "SHARE_LINK_MAINTENANCE_REQUEST_TIMEOUT_MS": "10000",
+    "SIGNING_AUTHORITY_ENDPOINT": "https://staging.api.learncard.app/api",
+    "SKILL_EMBEDDING_GOOGLE_MODEL": "gemini-embedding-001"
+}

package/config/config.example.json

@@ -0,0 +1,29 @@
+{
+    "CLIENT_APP_DOMAIN_NAME": "example.com",
+    "CREDENTIAL_REFRESH_ENABLED": "false",
+    "CREDENTIAL_REFRESH_NOTIFICATION_WINDOW_HOURS": "24",
+    "DOMAIN_NAME": "network.example.com",
+    "INBOX_BATCH_ITEMS_PER_HOUR": "10000",
+    "INBOX_DELETE_EXPIRED_RECORDS": "false",
+    "MESSAGEBIRD_ORIGINATOR": "+10000000000",
+    "OIDC_EXPECTED_AUDIENCE": "example",
+    "OIDC_TRUSTED_ISSUERS": "https://securetoken.google.com/example",
+    "POSTMARK_FROM_EMAIL": "inbox@example.com",
+    "SENTRY_ENV": "lcn-example",
+    "SHARE_LINK_MAINTENANCE_ALLOW_INSECURE_LOOPBACK": "false",
+    "SHARE_LINK_MAINTENANCE_AUDIENCE": "did:web:cloud.example.com",
+    "SHARE_LINK_MAINTENANCE_BUDGET_MS": "60000",
+    "SHARE_LINK_MAINTENANCE_CLAIM_MS": "300000",
+    "SHARE_LINK_MAINTENANCE_CLAIMANT": "brain-share-link-maintenance",
+    "SHARE_LINK_MAINTENANCE_CLEANUP_LIMIT": "25",
+    "SHARE_LINK_MAINTENANCE_FINALIZE_RESERVE_MS": "5000",
+    "SHARE_LINK_MAINTENANCE_GRAPH_TIMEOUT_MS": "15000",
+    "SHARE_LINK_MAINTENANCE_INTERVAL_MS": "300000",
+    "SHARE_LINK_MAINTENANCE_LEASE_MS": "120000",
+    "SHARE_LINK_MAINTENANCE_NAMESPACE": "example",
+    "SHARE_LINK_MAINTENANCE_ORIGIN": "https://cloud.example.com",
+    "SHARE_LINK_MAINTENANCE_RECOVERY_LIMIT": "25",
+    "SHARE_LINK_MAINTENANCE_REQUEST_TIMEOUT_MS": "10000",
+    "SIGNING_AUTHORITY_ENDPOINT": "https://api.example.com/api",
+    "SKILL_EMBEDDING_GOOGLE_MODEL": "gemini-embedding-001"
+}

package/config/config.json

@@ -0,0 +1 @@
+{}

package/config/config.production.json

@@ -0,0 +1,29 @@
+{
+    "CLIENT_APP_DOMAIN_NAME": "learncard.app",
+    "CREDENTIAL_REFRESH_ENABLED": "true",
+    "CREDENTIAL_REFRESH_NOTIFICATION_WINDOW_HOURS": "12",
+    "DOMAIN_NAME": "network.learncard.com",
+    "INBOX_BATCH_ITEMS_PER_HOUR": "10000",
+    "INBOX_DELETE_EXPIRED_RECORDS": "false",
+    "MESSAGEBIRD_ORIGINATOR": "+12077447198",
+    "OIDC_EXPECTED_AUDIENCE": "learncard",
+    "OIDC_TRUSTED_ISSUERS": "https://securetoken.google.com/learncard",
+    "POSTMARK_FROM_EMAIL": "inbox@learncard.com",
+    "SENTRY_ENV": "lcn-production",
+    "SHARE_LINK_MAINTENANCE_ALLOW_INSECURE_LOOPBACK": "false",
+    "SHARE_LINK_MAINTENANCE_AUDIENCE": "did:web:cloud.learncard.com",
+    "SHARE_LINK_MAINTENANCE_BUDGET_MS": "60000",
+    "SHARE_LINK_MAINTENANCE_CLAIMANT": "brain-share-link-maintenance",
+    "SHARE_LINK_MAINTENANCE_CLAIM_MS": "300000",
+    "SHARE_LINK_MAINTENANCE_CLEANUP_LIMIT": "25",
+    "SHARE_LINK_MAINTENANCE_FINALIZE_RESERVE_MS": "5000",
+    "SHARE_LINK_MAINTENANCE_GRAPH_TIMEOUT_MS": "15000",
+    "SHARE_LINK_MAINTENANCE_INTERVAL_MS": "300000",
+    "SHARE_LINK_MAINTENANCE_LEASE_MS": "120000",
+    "SHARE_LINK_MAINTENANCE_NAMESPACE": "learncard",
+    "SHARE_LINK_MAINTENANCE_ORIGIN": "https://cloud.learncard.com",
+    "SHARE_LINK_MAINTENANCE_RECOVERY_LIMIT": "25",
+    "SHARE_LINK_MAINTENANCE_REQUEST_TIMEOUT_MS": "10000",
+    "SIGNING_AUTHORITY_ENDPOINT": "https://api.learncard.app/api",
+    "SKILL_EMBEDDING_GOOGLE_MODEL": "gemini-embedding-001"
+}