@learncard/network-brain-service 3.19.0 → 4.0.0

package/lambda.ts

@@ -1,200 +1,57 @@
-import serverlessHttp from 'serverless-http';
-import type {
-    Context,
-    APIGatewayProxyResultV2,
-    APIGatewayProxyEventV2,
-    SQSBatchResponse,
-    SQSHandler,
-} from 'aws-lambda';
-import { awsLambdaRequestHandler } from '@trpc/server/adapters/aws-lambda';
-import * as Sentry from '@sentry/serverless';
-
-import app from './src/openapi';
-import skillsViewerApp from './src/skills-viewer';
-import statusListsApp from './src/status-lists';
-import credentialRefreshApp from './src/credential-refresh';
-import { appRouter, createContext } from './src/app';
-import { deliverQueuedNotification } from './src/helpers/notificationQueue.helpers';
-import { startSkillEmbeddingBackfill } from './src/helpers/skill-embedding.helpers';
-import { createOpenApiAwsLambdaHandler } from './src/helpers/shim';
-import {
-    handleTrpcError,
-    sentryBeforeSend,
-    getTracesSampleRate,
-} from './src/helpers/sentry.helpers';
-import { environment } from './src/config/environment';
-import { toServerlessApplication } from './src/helpers/serverlessApplication';
-import { runInboxMaintenance } from './src/helpers/inbox-maintenance.helpers';
-import {
-    inboxBatchResponseMeta,
-    withInboxBatchBodyLimit,
-} from './src/helpers/inbox-batch-http.helpers';
-
-Sentry.AWSLambda.init({
-    dsn: environment.SENTRY_DSN,
-    environment: environment.SENTRY_ENV,
-    enabled: Boolean(environment.SENTRY_DSN),
-    tracesSampleRate: getTracesSampleRate(),
-    beforeSend: sentryBeforeSend,
-    integrations: [
-        new Sentry.Integrations.Console(),
-        new Sentry.Integrations.Http({ tracing: true }),
-        new Sentry.Integrations.ContextLines(),
-    ],
-});
+import { bootstrapLambda } from '@learncard/service-config';
 
-startSkillEmbeddingBackfill().catch(err =>
-    console.error('Skill embedding backfill startup error:', err)
-);
+import { base, stages } from './src/config/stageConfig';
 
-export const swaggerUiHandler = serverlessHttp(toServerlessApplication(app), {
-    basePath: '/docs',
-});
+type LambdaApp = typeof import('./lambdaApp');
 
-export const skillsViewerHandler = serverlessHttp(toServerlessApplication(skillsViewerApp));
-
-export const statusListsHandler = serverlessHttp(toServerlessApplication(statusListsApp));
-
-// Passing the Fastify instance selects serverless-http's inject adapter, which
-// drops the API Gateway source address. The HTTP server path preserves it.
-const credentialRefreshProxy = serverlessHttp(toServerlessApplication(credentialRefreshApp.server));
-export const credentialRefreshHandler: typeof credentialRefreshProxy = async (event, context) => {
-    await credentialRefreshApp.ready();
-    return credentialRefreshProxy(event, context);
-};
-
-export const _openApiHandler = createOpenApiAwsLambdaHandler({
-    router: appRouter,
-    responseMeta: meta => {
-        return {
-            ...inboxBatchResponseMeta(meta),
-            headers: {
-                'Access-Control-Allow-Origin': '*',
-                'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
-                'Access-Control-Allow-Headers': 'Authorization, Content-Type',
-            },
-        };
-    },
-    createContext,
-    onError: handleTrpcError,
+const getApplication = bootstrapLambda<LambdaApp>({
+    base,
+    stages,
+    stage: process.env.AWS_LAMBDA_FUNCTION_NAME
+        ? process.env.LAMBDA_STAGE
+        : process.env.CONFIG_STAGE,
+    importApp: () => import('./lambdaApp'),
 });
 
-export const _trpcHandler = withInboxBatchBodyLimit(
-    awsLambdaRequestHandler({
-        allowMethodOverride: true,
-        router: appRouter,
-        createContext,
-        onError: handleTrpcError,
-        responseMeta: () => {
-            return {
-                headers: {
-                    'Access-Control-Allow-Origin': '*',
-                    'Access-Control-Allow-Methods': '*',
-                    'Access-Control-Allow-Headers': 'authorization',
-                },
-            };
-        },
-    }),
-    'trpc'
-);
-
-export const openApiHandler = Sentry.AWSLambda.wrapHandler(
-    async (event: APIGatewayProxyEventV2, context: Context): Promise<APIGatewayProxyResultV2> => {
-        if (event.requestContext.http.method === 'OPTIONS') {
-            return {
-                statusCode: 204,
-                headers: {
-                    'Access-Control-Allow-Origin': '*',
-                    'Access-Control-Allow-Headers': 'Authorization, Content-Type',
-                    'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
-                },
-            };
-        }
-
-        return _openApiHandler(event, context);
-    }
-);
-
-export const trpcHandler = Sentry.AWSLambda.wrapHandler(
-    async (event: APIGatewayProxyEventV2, context: Context): Promise<APIGatewayProxyResultV2> => {
-        if (event.requestContext.http.method === 'OPTIONS') {
-            return {
-                statusCode: 200,
-                headers: {
-                    'Access-Control-Allow-Origin': '*',
-                    'Access-Control-Allow-Headers': '*',
-                    'Access-Control-Allow-Methods': '*',
-                },
-            };
-        }
-
-        return _trpcHandler(event, context);
-    }
-);
-
-export const inboxQueueWorker: SQSHandler = Sentry.AWSLambda.wrapHandler(async event => {
-    const { processInboxQueueMessage } = await import('./src/helpers/inbox-queue.helpers');
-    const batchItemFailures = [];
-    for (const record of event.Records) {
-        try {
-            await processInboxQueueMessage(record.body);
-        } catch {
-            console.error('Inbox worker message failed', { messageId: record.messageId });
-            batchItemFailures.push({ itemIdentifier: record.messageId });
-        }
-    }
-    return { batchItemFailures } satisfies SQSBatchResponse;
-});
+export const trpcHandler = async (...args: Parameters<LambdaApp['trpcHandler']>) =>
+    (await getApplication()).trpcHandler(...args);
 
-export const inboxQueueDispatcher = Sentry.AWSLambda.wrapHandler(
-    async (_event: unknown, context: Context): Promise<void> => {
-        const { dispatchInboxJobs } = await import('./src/helpers/inbox-queue.helpers');
-        // Share one clock across publication and recovery, retaining five seconds for shutdown.
-        const deadline = Date.now() + Math.max(0, context.getRemainingTimeInMillis() - 5_000);
-        await dispatchInboxJobs(deadline);
-    }
-);
-
-export const inboxDeadLetterWorker: SQSHandler = Sentry.AWSLambda.wrapHandler(async event => {
-    const { processInboxDeadLetter } = await import('./src/helpers/inbox-queue.helpers');
-    const batchItemFailures = [];
-    for (const record of event.Records) {
-        try {
-            await processInboxDeadLetter(record.body);
-        } catch {
-            console.error('Inbox dead-letter processing failed', { messageId: record.messageId });
-            batchItemFailures.push({ itemIdentifier: record.messageId });
-        }
-    }
-    return { batchItemFailures } satisfies SQSBatchResponse;
-});
+export const openApiHandler = async (...args: Parameters<LambdaApp['openApiHandler']>) =>
+    (await getApplication()).openApiHandler(...args);
 
-export const notificationsWorker: SQSHandler = Sentry.AWSLambda.wrapHandler(async event => {
-    const batchItemFailures = await Promise.all(
-        event.Records.map(async record => {
-            try {
-                await deliverQueuedNotification(record.body);
-
-                return undefined;
-            } catch (error) {
-                console.error('Notification queue record failed', {
-                    messageId: record.messageId,
-                    error,
-                });
-
-                return { itemIdentifier: record.messageId };
-            }
-        })
-    );
-
-    return {
-        batchItemFailures: batchItemFailures.filter(
-            (failure): failure is { itemIdentifier: string } => failure !== undefined
-        ),
-    } satisfies SQSBatchResponse;
-});
+export const _trpcHandler = async (...args: Parameters<LambdaApp['_trpcHandler']>) =>
+    (await getApplication())._trpcHandler(...args);
 
-export const inboxMaintenanceHandler = Sentry.AWSLambda.wrapHandler(async (): Promise<void> => {
-    const counts = await runInboxMaintenance();
-    console.log('Universal Inbox maintenance completed', counts);
-});
+export const _openApiHandler = async (...args: Parameters<LambdaApp['_openApiHandler']>) =>
+    (await getApplication())._openApiHandler(...args);
+
+export const swaggerUiHandler = async (...args: Parameters<LambdaApp['swaggerUiHandler']>) =>
+    (await getApplication()).swaggerUiHandler(...args);
+
+export const skillsViewerHandler = async (...args: Parameters<LambdaApp['skillsViewerHandler']>) =>
+    (await getApplication()).skillsViewerHandler(...args);
+
+export const statusListsHandler = async (...args: Parameters<LambdaApp['statusListsHandler']>) =>
+    (await getApplication()).statusListsHandler(...args);
+
+export const credentialRefreshHandler = async (
+    ...args: Parameters<LambdaApp['credentialRefreshHandler']>
+) => (await getApplication()).credentialRefreshHandler(...args);
+
+export const inboxQueueWorker = async (...args: Parameters<LambdaApp['inboxQueueWorker']>) =>
+    (await getApplication()).inboxQueueWorker(...args);
+
+export const inboxQueueDispatcher = async (
+    ...args: Parameters<LambdaApp['inboxQueueDispatcher']>
+) => (await getApplication()).inboxQueueDispatcher(...args);
+
+export const inboxDeadLetterWorker = async (
+    ...args: Parameters<LambdaApp['inboxDeadLetterWorker']>
+) => (await getApplication()).inboxDeadLetterWorker(...args);
+
+export const notificationsWorker = async (...args: Parameters<LambdaApp['notificationsWorker']>) =>
+    (await getApplication()).notificationsWorker(...args);
+
+export const inboxMaintenanceHandler = async (
+    ...args: Parameters<LambdaApp['inboxMaintenanceHandler']>
+) => (await getApplication()).inboxMaintenanceHandler(...args);

package/lambdaApp.ts

@@ -0,0 +1,203 @@
+import serverlessHttp from 'serverless-http';
+import type {
+    Context,
+    APIGatewayProxyResultV2,
+    APIGatewayProxyEventV2,
+    SQSBatchResponse,
+    SQSHandler,
+} from 'aws-lambda';
+import { awsLambdaRequestHandler } from '@trpc/server/adapters/aws-lambda';
+import * as Sentry from '@sentry/serverless';
+
+import app from './src/openapi';
+import skillsViewerApp from './src/skills-viewer';
+import statusListsApp from './src/status-lists';
+import credentialRefreshApp from './src/credential-refresh';
+import { appRouter, createContext } from './src/app';
+import { publicShareLinkCacheControlHeaders } from './src/routes';
+import { deliverQueuedNotification } from './src/helpers/notificationQueue.helpers';
+import { startSkillEmbeddingBackfill } from './src/helpers/skill-embedding.helpers';
+import { createOpenApiAwsLambdaHandler } from './src/helpers/shim';
+import {
+    handleTrpcError,
+    sentryBeforeSend,
+    getTracesSampleRate,
+} from './src/helpers/sentry.helpers';
+import { environment } from './src/config/environment';
+import { toServerlessApplication } from './src/helpers/serverlessApplication';
+import { runInboxMaintenance } from './src/helpers/inbox-maintenance.helpers';
+import {
+    inboxBatchResponseMeta,
+    withInboxBatchBodyLimit,
+} from './src/helpers/inbox-batch-http.helpers';
+
+Sentry.AWSLambda.init({
+    dsn: environment.SENTRY_DSN,
+    environment: environment.SENTRY_ENV,
+    enabled: Boolean(environment.SENTRY_DSN),
+    tracesSampleRate: getTracesSampleRate(),
+    beforeSend: sentryBeforeSend,
+    integrations: [
+        new Sentry.Integrations.Console(),
+        new Sentry.Integrations.Http({ tracing: true }),
+        new Sentry.Integrations.ContextLines(),
+    ],
+});
+
+startSkillEmbeddingBackfill().catch(err =>
+    console.error('Skill embedding backfill startup error:', err)
+);
+
+export const swaggerUiHandler = serverlessHttp(toServerlessApplication(app), {
+    basePath: '/docs',
+});
+
+export const skillsViewerHandler = serverlessHttp(toServerlessApplication(skillsViewerApp));
+
+export const statusListsHandler = serverlessHttp(toServerlessApplication(statusListsApp));
+
+// Passing the Fastify instance selects serverless-http's inject adapter, which
+// drops the API Gateway source address. The HTTP server path preserves it.
+const credentialRefreshProxy = serverlessHttp(toServerlessApplication(credentialRefreshApp.server));
+export const credentialRefreshHandler: typeof credentialRefreshProxy = async (event, context) => {
+    await credentialRefreshApp.ready();
+    return credentialRefreshProxy(event, context);
+};
+
+export const _openApiHandler = createOpenApiAwsLambdaHandler({
+    router: appRouter,
+    responseMeta: meta => {
+        return {
+            ...inboxBatchResponseMeta(meta),
+            headers: {
+                'Access-Control-Allow-Origin': '*',
+                'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
+                'Access-Control-Allow-Headers': 'Authorization, Content-Type',
+                ...publicShareLinkCacheControlHeaders(meta.paths),
+            },
+        };
+    },
+    createContext,
+    onError: handleTrpcError,
+});
+
+export const _trpcHandler = withInboxBatchBodyLimit(
+    awsLambdaRequestHandler({
+        allowMethodOverride: true,
+        router: appRouter,
+        createContext,
+        onError: handleTrpcError,
+        responseMeta: ({ paths }) => {
+            return {
+                headers: {
+                    'Access-Control-Allow-Origin': '*',
+                    'Access-Control-Allow-Methods': '*',
+                    'Access-Control-Allow-Headers': 'authorization',
+                    ...publicShareLinkCacheControlHeaders(paths),
+                },
+            };
+        },
+    }),
+    'trpc'
+);
+
+export const openApiHandler = Sentry.AWSLambda.wrapHandler(
+    async (event: APIGatewayProxyEventV2, context: Context): Promise<APIGatewayProxyResultV2> => {
+        if (event.requestContext.http.method === 'OPTIONS') {
+            return {
+                statusCode: 204,
+                headers: {
+                    'Access-Control-Allow-Origin': '*',
+                    'Access-Control-Allow-Headers': 'Authorization, Content-Type',
+                    'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
+                },
+            };
+        }
+
+        return _openApiHandler(event, context);
+    }
+);
+
+export const trpcHandler = Sentry.AWSLambda.wrapHandler(
+    async (event: APIGatewayProxyEventV2, context: Context): Promise<APIGatewayProxyResultV2> => {
+        if (event.requestContext.http.method === 'OPTIONS') {
+            return {
+                statusCode: 200,
+                headers: {
+                    'Access-Control-Allow-Origin': '*',
+                    'Access-Control-Allow-Headers': '*',
+                    'Access-Control-Allow-Methods': '*',
+                },
+            };
+        }
+
+        return _trpcHandler(event, context);
+    }
+);
+
+export const inboxQueueWorker: SQSHandler = Sentry.AWSLambda.wrapHandler(async event => {
+    const { processInboxQueueMessage } = await import('./src/helpers/inbox-queue.helpers');
+    const batchItemFailures = [];
+    for (const record of event.Records) {
+        try {
+            await processInboxQueueMessage(record.body);
+        } catch {
+            console.error('Inbox worker message failed', { messageId: record.messageId });
+            batchItemFailures.push({ itemIdentifier: record.messageId });
+        }
+    }
+    return { batchItemFailures } satisfies SQSBatchResponse;
+});
+
+export const inboxQueueDispatcher = Sentry.AWSLambda.wrapHandler(
+    async (_event: unknown, context: Context): Promise<void> => {
+        const { dispatchInboxJobs } = await import('./src/helpers/inbox-queue.helpers');
+        // Share one clock across publication and recovery, retaining five seconds for shutdown.
+        const deadline = Date.now() + Math.max(0, context.getRemainingTimeInMillis() - 5_000);
+        await dispatchInboxJobs(deadline);
+    }
+);
+
+export const inboxDeadLetterWorker: SQSHandler = Sentry.AWSLambda.wrapHandler(async event => {
+    const { processInboxDeadLetter } = await import('./src/helpers/inbox-queue.helpers');
+    const batchItemFailures = [];
+    for (const record of event.Records) {
+        try {
+            await processInboxDeadLetter(record.body);
+        } catch {
+            console.error('Inbox dead-letter processing failed', { messageId: record.messageId });
+            batchItemFailures.push({ itemIdentifier: record.messageId });
+        }
+    }
+    return { batchItemFailures } satisfies SQSBatchResponse;
+});
+
+export const notificationsWorker: SQSHandler = Sentry.AWSLambda.wrapHandler(async event => {
+    const batchItemFailures = await Promise.all(
+        event.Records.map(async record => {
+            try {
+                await deliverQueuedNotification(record.body);
+
+                return undefined;
+            } catch (error) {
+                console.error('Notification queue record failed', {
+                    messageId: record.messageId,
+                    error,
+                });
+
+                return { itemIdentifier: record.messageId };
+            }
+        })
+    );
+
+    return {
+        batchItemFailures: batchItemFailures.filter(
+            (failure): failure is { itemIdentifier: string } => failure !== undefined
+        ),
+    } satisfies SQSBatchResponse;
+});
+
+export const inboxMaintenanceHandler = Sentry.AWSLambda.wrapHandler(async (): Promise<void> => {
+    const counts = await runInboxMaintenance();
+    console.log('Universal Inbox maintenance completed', counts);
+});

package/package.json

@@ -1,11 +1,11 @@
 {
     "name": "@learncard/network-brain-service",
-    "version": "3.19.0",
+    "version": "4.0.0",
     "description": "",
     "engines": {
         "node": ">=24.12 <25"
     },
-    "packageManager": "bun@1.3.14",
+    "packageManager": "bun@1.4.2",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",
     "scripts": {
@@ -19,6 +19,7 @@
         "test:integration:watch": "vitest --config vitest.integration.config.ts",
         "test:docker": "vitest run --config vitest.integration.config.ts",
         "seed:dev-app": "bun scripts/seed-dev-app.ts",
+        "seed:demo-persona": "bun --conditions=development scripts/seed-demo-persona.ts",
         "skill-frameworks": "bun scripts/skill-frameworks.ts",
         "build": "shx rm -rf dist && node bundle.mjs && tsc --p tsconfig.build.json && tsc --showConfig --p tsconfig.build.json > tsconfig.temp.json && tsc-alias --replacer ./tsc-alias-replacer.cjs -p tsconfig.temp.json && shx rm tsconfig.temp.json",
         "typecheck": "tsc --noEmit -p tsconfig.build.json && tsc --noEmit -p tsconfig.entrypoints.json",
@@ -61,27 +62,32 @@
         "@digitalcredentials/issuer-registry-client": "^3.2.0-beta.5",
         "@fastify/cors": "^11.2.0",
         "@google/genai": "^1.27.0",
-        "@learncard/core": "9.4.36",
-        "@learncard/crypto-plugin": "1.1.36",
-        "@learncard/did-web-plugin": "1.1.36",
-        "@learncard/didkey-plugin": "1.1.36",
-        "@learncard/didkit-plugin": "1.10.1",
-        "@learncard/didkit-plugin-node": "0.3.1",
-        "@learncard/dynamic-loader-plugin": "1.1.36",
-        "@learncard/encryption-plugin": "1.1.36",
-        "@learncard/expiration-plugin": "1.2.36",
-        "@learncard/email-templates": "1.1.0",
-        "@learncard/helpers": "1.6.0",
-        "@learncard/learn-card-plugin": "1.2.36",
-        "@learncard/types": "5.21.0",
-        "@learncard/vc-plugin": "1.6.2",
-        "@learncard/vc-templates-plugin": "1.1.36",
+        "@learncard/credential-library": "2.1.0",
+        "@learncard/core": "9.4.38",
+        "@learncard/crypto-plugin": "1.1.38",
+        "@learncard/did-web-plugin": "1.1.38",
+        "@learncard/didkey-plugin": "1.1.38",
+        "@learncard/didkit-plugin": "1.10.3",
+        "@learncard/didkit-plugin-node": "0.3.3",
+        "@learncard/dynamic-loader-plugin": "1.1.38",
+        "@learncard/encryption-plugin": "1.1.38",
+        "@learncard/expiration-plugin": "1.2.38",
+        "@learncard/email-templates": "1.2.1",
+        "@learncard/helpers": "1.6.2",
+        "@learncard/learn-card-plugin": "1.2.38",
+        "@learncard/partner-connect-core": "0.2.0",
+        "@learncard/service-config": "0.1.1",
+        "@learncard/types": "5.23.0",
+        "@learncard/vc-plugin": "1.6.4",
+        "@learncard/vc-templates-plugin": "1.1.38",
         "@sentry/serverless": "7.61.0",
         "@trpc/server": "11.8.0",
         "@types/lodash": "^4.14.191",
         "base64url": "^3.0.1",
+        "bs58": "^5.0.0",
         "cors": "^2.8.5",
         "dotenv": "^16.0.3",
+        "hash-wasm": "^4.12.0",
         "express": "^4.18.2",
         "fastify": "^5.8.5",
         "fastify-plugin": "^5.1.0",
@@ -93,6 +99,7 @@
         "lodash": "^4.17.21",
         "messagebird": "^4.0.1",
         "multiformats": "^11.0.1",
+        "mongodb": "^6.2.0",
         "mustache": "^4.2.0",
         "neo4j-driver": "5.18.0",
         "neogma": "1.13.0",
@@ -103,6 +110,7 @@
         "tsc-alias": "^1.8.10",
         "twilio": "^5.7.1",
         "undici": "^6",
+        "tweetnacl": "^1.0.3",
         "uuid": "^14.0.0",
         "zod": "4.4.3",
         "zod-openapi": "^5.0.1"

package/scripts/export-openapi.ts

@@ -0,0 +1,20 @@
+import { resolve } from 'node:path';
+import { configureOfflineSchemaEnvironment } from './offline-schema-environment';
+
+const output = process.argv[2];
+if (!output)
+    throw new Error('Usage: bun --conditions=development scripts/export-openapi.ts OUTPUT');
+
+// Schema export registers routes, but never calls them or loads local credentials.
+configureOfflineSchemaEnvironment();
+
+// Static imports would initialize the router before service credentials are removed.
+const { openApiDocument } = await import('../src/openapi');
+
+await Bun.write(
+    resolve(output),
+    `${JSON.stringify(openApiDocument, null, 2)}
+`
+);
+console.log(`Exported ${Object.keys(openApiDocument.paths ?? {}).length} local OpenAPI paths`);
+process.exit(0);

package/scripts/offline-schema-environment.ts

@@ -0,0 +1,18 @@
+// These tools only import validators/routes; they must never inherit service credentials.
+export function configureOfflineSchemaEnvironment(): void {
+    for (const name of Object.keys(process.env)) {
+        if (!['PATH', 'HOME', 'TMPDIR'].includes(name)) delete process.env[name];
+    }
+    Object.assign(process.env, {
+        NODE_ENV: 'test',
+        DOTENV_CONFIG_PATH: '/dev/null',
+        SEED: 'a'.repeat(64),
+        NEO4J_URI: 'bolt://127.0.0.1:1',
+        NEO4J_USERNAME: 'schema-export',
+        NEO4J_PASSWORD: 'synthetic-schema-export',
+        NEO4J_SKIP_INDICES: 'true',
+        SKIP_DIDKIT_NAPI: 'true',
+        SKIP_SKILL_FRAMEWORK_SEED: 'true',
+        TRACE_CONSOLE: 'false',
+    });
+}