@learncard/network-brain-service 3.19.0 → 4.0.0

package/scripts/seed-demo-persona.ts

@@ -0,0 +1,425 @@
+#!/usr/bin/env bun
+/**
+ * Publish a credential-library persona as a ConsentFlow contract with auto-boosts.
+ *
+ * Usage (from services/learn-card-network/brain-service):
+ *   bun run seed:demo-persona student
+ *
+ * The script is idempotent: profile, signing authority, Boost, contract, and
+ * AUTO_RECEIVE identifiers are stable. Re-running updates fixture content and
+ * replaces the contract's auto-boost set without changing its URI.
+ *
+ * Every target requires explicit database, domain, signing-authority endpoint,
+ * and 64-character signing seed configuration.
+ */
+
+import { fileURLToPath } from 'url';
+import { createHmac } from 'node:crypto';
+
+import * as bs58 from 'bs58';
+import * as dotenv from 'dotenv';
+import { MongoClient } from 'mongodb';
+import { Neogma } from 'neogma';
+import Redis from 'ioredis';
+import * as nacl from 'tweetnacl';
+import { v4 as uuid, v5 as uuidv5 } from 'uuid';
+
+import {
+    getBundle,
+    getFixture,
+    prepareFixture,
+    type CredentialBundleEntry,
+    type CredentialBundleIssuer,
+} from '@learncard/credential-library';
+import type { UnsignedVC } from '@learncard/types';
+import { flattenObject } from '../src/helpers/objects.helpers';
+
+dotenv.config({ path: fileURLToPath(new URL('../.env', import.meta.url)) });
+
+const PERSONA_NAMESPACE = '5c4bb193-6e65-43d9-940d-d85b758a94f2';
+const SIGNING_AUTHORITY_NAME = 'sample-personas';
+
+const NEO4J_URI = process.env.NEO4J_URI ?? 'bolt://localhost:7687';
+const NEO4J_USERNAME = process.env.NEO4J_USERNAME ?? 'neo4j';
+const NEO4J_PASSWORD = process.env.NEO4J_PASSWORD ?? 'this-is-the-password';
+const MONGO_URI = process.env.MONGO_URI ?? 'mongodb://localhost:27017/?replicaSet=rs0';
+const MONGO_DB_NAME = process.env.MONGO_DB_NAME ?? 'lca-api';
+const REDIS_HOST = process.env.REDIS_HOST ?? 'localhost';
+const REDIS_PORT = Number.parseInt(process.env.REDIS_PORT ?? '6379', 10);
+const BRAIN_DOMAIN = process.env.DOMAIN_NAME || 'localhost%3A4000';
+const SIGNING_AUTHORITY_ENDPOINT = process.env.DEMO_PERSONA_SIGNING_AUTHORITY_ENDPOINT;
+const SIGNING_AUTHORITY_SEED = process.env.DEMO_PERSONA_SA_SEED;
+
+const personaId = process.argv[2];
+
+if (!personaId) {
+    throw new Error('Usage: bun scripts/seed-demo-persona.ts <personaId>');
+}
+
+if (!SIGNING_AUTHORITY_SEED || !SIGNING_AUTHORITY_ENDPOINT) {
+    throw new Error(
+        'DEMO_PERSONA_SA_SEED and DEMO_PERSONA_SIGNING_AUTHORITY_ENDPOINT are required.'
+    );
+}
+
+if (!/^[0-9a-f]{64}$/i.test(SIGNING_AUTHORITY_SEED)) {
+    throw new Error('DEMO_PERSONA_SA_SEED must contain exactly 64 hexadecimal characters.');
+}
+
+const transformProfileId = (raw: string): string => raw.toLowerCase().replace(/:/g, '%3A');
+
+const getDidWeb = (domain: string, profileId: string): string =>
+    `did:web:${domain}:users:${profileId}`;
+
+const constructContractUri = (contractId: string): string => {
+    const encodedDomain = BRAIN_DOMAIN.includes('localhost')
+        ? BRAIN_DOMAIN.replace(/:/g, '%3A')
+        : BRAIN_DOMAIN.replace(/:/g, '/');
+
+    return `lc:network:${encodedDomain.replace(/\/trpc$/, '')}/trpc:contract:${contractId}`;
+};
+
+const deriveDidKeyFromSeed = (hexSeed: string): string => {
+    const seedBytes = Buffer.from(hexSeed, 'hex');
+    const keyPair = nacl.sign.keyPair.fromSeed(seedBytes);
+    const multicodec = Buffer.concat([Buffer.from('ed01', 'hex'), Buffer.from(keyPair.publicKey)]);
+
+    return `did:key:z${bs58.encode(multicodec)}`;
+};
+const deriveSigningAuthoritySeed = (profileId: string): string =>
+    createHmac('sha256', Buffer.from(SIGNING_AUTHORITY_SEED, 'hex'))
+        .update(`learncard:sample-persona:${profileId}`)
+        .digest('hex');
+
+const clearProfileDidDocumentCache = async (profileId: string): Promise<void> => {
+    const redis = new Redis({
+        host: REDIS_HOST,
+        port: REDIS_PORT,
+        lazyConnect: true,
+        connectTimeout: 2_000,
+        retryStrategy: () => null,
+    });
+
+    try {
+        await redis.connect();
+        await redis.del(`did-doc:${profileId}`);
+    } catch {
+        console.warn(
+            `Could not clear did-doc:${profileId} at ${REDIS_HOST}:${REDIS_PORT}; delete that Redis key manually, or restart the brain service if it uses an in-memory cache.`
+        );
+    } finally {
+        redis.disconnect();
+    }
+};
+
+const shiftDate = (offsetDays: number): string => {
+    const date = new Date();
+    date.setUTCDate(date.getUTCDate() + offsetDays);
+    return date.toISOString();
+};
+
+const prepareBundleCredential = (entry: CredentialBundleEntry, issuerDid: string): UnsignedVC => {
+    const fixture = getFixture(entry.fixtureId);
+    const prepared = prepareFixture(fixture, {
+        issuerDid,
+        subjectDid: 'did:example:123',
+        validFrom: shiftDate(entry.validFromOffsetDays),
+        freshIds: false,
+    });
+
+    if (entry.name) prepared.name = entry.name;
+
+    return prepared;
+};
+
+const toBoostTemplate = (credential: UnsignedVC, issuerDid: string): string => {
+    const template = structuredClone(credential) as Record<string, unknown>;
+    delete template.id;
+    delete template.proof;
+    template.issuer = issuerDid;
+
+    const subjects = Array.isArray(template.credentialSubject)
+        ? template.credentialSubject
+        : [template.credentialSubject];
+    for (const subject of subjects) {
+        if (subject && typeof subject === 'object') {
+            Object.assign(subject, { id: 'did:example:123' });
+        }
+    }
+
+    return JSON.stringify(template);
+};
+
+const ensureSigningAuthority = async (
+    ownerDid: string,
+    did: string,
+    seed: string
+): Promise<void> => {
+    const client = new MongoClient(MONGO_URI);
+
+    try {
+        await client.connect();
+        await client
+            .db(MONGO_DB_NAME)
+            .collection('signingauthorities')
+            .updateOne(
+                { ownerDid, name: SIGNING_AUTHORITY_NAME },
+                {
+                    $set: { seed, did },
+                    $setOnInsert: { _id: uuid(), ownerDid, name: SIGNING_AUTHORITY_NAME },
+                },
+                { upsert: true }
+            );
+    } finally {
+        await client.close();
+    }
+};
+
+const main = async (): Promise<void> => {
+    const bundle = getBundle(personaId);
+    const [firstEntry] = bundle.entries;
+    if (!firstEntry) {
+        throw new Error(`Credential bundle ${bundle.id} has no entries.`);
+    }
+
+    const issuerProfiles = new Map<
+        string,
+        CredentialBundleIssuer & {
+            profileId: `sample-${string}`;
+            did: string;
+            signingAuthorityDid: string;
+            signingAuthoritySeed: string;
+        }
+    >();
+    for (const entry of bundle.entries) {
+        const profileId = transformProfileId(entry.issuer.profileId);
+        if (!profileId.startsWith('sample-')) {
+            throw new Error(`Refusing to seed non-sample issuer profile: ${profileId}`);
+        }
+        const existingIssuer = issuerProfiles.get(profileId);
+
+        if (
+            existingIssuer &&
+            (existingIssuer.displayName !== entry.issuer.displayName ||
+                existingIssuer.image !== entry.issuer.image)
+        ) {
+            throw new Error(`Conflicting metadata configured for sample issuer ${profileId}.`);
+        }
+
+        const signingAuthoritySeed = deriveSigningAuthoritySeed(profileId);
+        const signingAuthorityDid = deriveDidKeyFromSeed(signingAuthoritySeed);
+        issuerProfiles.set(profileId, {
+            ...entry.issuer,
+            profileId: profileId as `sample-${string}`,
+            did: getDidWeb(BRAIN_DOMAIN, profileId),
+            signingAuthorityDid,
+            signingAuthoritySeed,
+        });
+    }
+
+    const contractOwnerProfileId = transformProfileId(firstEntry.issuer.profileId);
+    const contractId = uuidv5(`persona:${bundle.id}:contract`, PERSONA_NAMESPACE);
+    const neogma = new Neogma({
+        url: NEO4J_URI,
+        username: NEO4J_USERNAME,
+        password: NEO4J_PASSWORD,
+    });
+    const run = neogma.queryRunner.run.bind(neogma.queryRunner);
+
+    try {
+        for (const issuer of issuerProfiles.values()) {
+            const profileResult = await run(
+                `MERGE (p:Profile {profileId: $profileId})
+                 ON CREATE SET p.isSamplePersona = true
+                 WITH p
+                 WHERE p.isSamplePersona = true
+                   AND (p.did IS NULL OR p.did = $did)
+                 SET p.displayName = $displayName,
+                     p.shortBio = $shortBio,
+                     p.image = $image,
+                     p.did = $did
+                 RETURN p.did AS did`,
+                {
+                    profileId: issuer.profileId,
+                    displayName: issuer.displayName,
+                    shortBio: 'Issuer for LearnCard sample credentials',
+                    image: issuer.image ?? '',
+                    did: issuer.signingAuthorityDid,
+                }
+            );
+            const storedSigningAuthorityDid = profileResult.records[0]?.get('did');
+            if (!storedSigningAuthorityDid) {
+                throw new Error(
+                    `Refusing to overwrite existing non-sample profile ${issuer.profileId}.`
+                );
+            }
+            if (storedSigningAuthorityDid !== issuer.signingAuthorityDid) {
+                throw new Error(
+                    `Profile ${issuer.profileId} did not retain its signing authority DID.`
+                );
+            }
+
+            await run(
+                `MERGE (sa:SigningAuthority {endpoint: $endpoint})
+                 WITH sa
+                 MATCH (p:Profile {profileId: $profileId})
+                 MERGE (p)-[r:USES_SIGNING_AUTHORITY {name: $name}]->(sa)
+                 SET r.did = $did, r.isPrimary = true
+                 RETURN r`,
+                {
+                    endpoint: SIGNING_AUTHORITY_ENDPOINT,
+                    profileId: issuer.profileId,
+                    name: SIGNING_AUTHORITY_NAME,
+                    did: issuer.signingAuthorityDid,
+                }
+            );
+            await clearProfileDidDocumentCache(issuer.profileId);
+            await ensureSigningAuthority(
+                issuer.did,
+                issuer.signingAuthorityDid,
+                issuer.signingAuthoritySeed
+            );
+        }
+
+        const autoBoosts: Array<{ boostId: string; issuerProfileId: string }> = [];
+        for (const entry of bundle.entries) {
+            const fixture = getFixture(entry.fixtureId);
+            const profileId = transformProfileId(entry.issuer.profileId);
+            const issuer = issuerProfiles.get(profileId);
+            if (!issuer) {
+                throw new Error(`Missing seeded issuer profile ${profileId}.`);
+            }
+
+            const boostId = uuidv5(
+                `persona:${bundle.id}:fixture:${entry.fixtureId}`,
+                PERSONA_NAMESPACE
+            );
+            const credential = prepareBundleCredential(entry, issuer.did);
+            const boost = toBoostTemplate(credential, issuer.did);
+            autoBoosts.push({ boostId, issuerProfileId: profileId });
+            const boostProperties = flattenObject({
+                id: boostId,
+                boost,
+                name: entry.name ?? fixture.name,
+                type: fixture.profile,
+                category: 'Achievement',
+                status: 'LIVE',
+                meta: { personaId: bundle.id, fixtureId: fixture.id },
+            });
+
+            const boostResult = await run(
+                `MERGE (b:Boost {id: $boostId})
+                 SET b = $properties
+                 WITH b
+                 OPTIONAL MATCH (b)-[oldCreated:CREATED_BY]->(:Profile)
+                 DELETE oldCreated
+                 WITH DISTINCT b
+                 OPTIONAL MATCH (:Profile)-[oldRole:HAS_ROLE {roleId: '__creator__'}]->(b)
+                 DELETE oldRole
+                 WITH DISTINCT b
+                 MATCH (p:Profile {profileId: $profileId})
+                 MERGE (b)-[created:CREATED_BY]->(p)
+                 SET created.date = $date
+                 MERGE (p)-[:HAS_ROLE {roleId: '__creator__'}]->(b)
+                 WITH b
+                 MATCH (b)-[:CREATED_BY]->(creator:Profile)
+                 MATCH (roleOwner:Profile)-[:HAS_ROLE {roleId: '__creator__'}]->(b)
+                 RETURN collect(creator.profileId) AS creatorProfileIds,
+                        collect(roleOwner.profileId) AS roleOwnerProfileIds`,
+                {
+                    boostId,
+                    properties: boostProperties,
+                    profileId,
+                    date: new Date().toISOString(),
+                }
+            );
+            const creatorProfileIds = boostResult.records[0]?.get('creatorProfileIds');
+            const roleOwnerProfileIds = boostResult.records[0]?.get('roleOwnerProfileIds');
+            if (
+                creatorProfileIds?.length !== 1 ||
+                creatorProfileIds[0] !== profileId ||
+                roleOwnerProfileIds?.length !== 1 ||
+                roleOwnerProfileIds[0] !== profileId
+            ) {
+                throw new Error(`Boost ${boostId} has ambiguous profile ownership.`);
+            }
+        }
+
+        const contract = {
+            read: {
+                personal: { name: { required: false } },
+                credentials: { categories: { Achievement: { required: false } } },
+            },
+            write: {
+                personal: {},
+                credentials: {
+                    categories: { Achievement: { required: false, defaultEnabled: true } },
+                },
+            },
+        };
+        const now = new Date().toISOString();
+        const contractProperties = flattenObject({
+            id: contractId,
+            name: `${bundle.displayName} Sample Credentials`,
+            subtitle: bundle.blurb,
+            description: bundle.blurb,
+            reasonForAccessing: '',
+            needsGuardianConsent: false,
+            redirectUrl: '',
+            frontDoorBoostUri: '',
+            image: '',
+            contract,
+            updatedAt: now,
+        });
+
+        await run(
+            `MERGE (c:ConsentFlowContract {id: $contractId})
+             ON CREATE SET c.createdAt = $createdAt
+             WITH c, c.createdAt AS createdAt
+             SET c = $properties,
+                 c.createdAt = createdAt
+             WITH c
+             OPTIONAL MATCH (c)-[oldOwner:CREATED_BY]->(:Profile)
+             DELETE oldOwner
+             WITH DISTINCT c
+             MATCH (p:Profile {profileId: $profileId})
+             MERGE (c)-[:CREATED_BY]->(p)
+             RETURN c`,
+            {
+                contractId,
+                createdAt: now,
+                profileId: contractOwnerProfileId,
+                properties: contractProperties,
+            }
+        );
+
+        await run(
+            `MATCH (c:ConsentFlowContract {id: $contractId})
+             OPTIONAL MATCH (c)-[old:AUTO_RECEIVE]->(:Boost)
+             DELETE old
+             WITH DISTINCT c
+             UNWIND $autoBoosts AS autoBoost
+             MATCH (b:Boost {id: autoBoost.boostId})
+             CREATE (c)-[:AUTO_RECEIVE {
+                 signingAuthorityEndpoint: $endpoint,
+                 signingAuthorityName: $name,
+                 issuer: autoBoost.issuerProfileId
+             }]->(b)`,
+            {
+                contractId,
+                autoBoosts,
+                endpoint: SIGNING_AUTHORITY_ENDPOINT,
+                name: SIGNING_AUTHORITY_NAME,
+            }
+        );
+
+        console.log(constructContractUri(contractId));
+    } finally {
+        await neogma.driver.close();
+    }
+};
+
+main().catch(error => {
+    console.error(error);
+    process.exitCode = 1;
+});

package/scripts/verify-python-contracts.ts

@@ -0,0 +1,72 @@
+import assert from 'node:assert/strict';
+import type { ZodType } from 'zod';
+
+import { configureOfflineSchemaEnvironment } from './offline-schema-environment';
+
+type CapturedRequest = {
+    method: string;
+    path: string;
+    body: unknown;
+    serverValid: boolean;
+};
+
+const capture = process.argv[2];
+if (!capture)
+    throw new Error(
+        'Usage: bun --conditions=development scripts/verify-python-contracts.ts CAPTURE'
+    );
+configureOfflineSchemaEnvironment();
+
+// Static imports would initialize router dependencies before credentials are removed.
+const { AllocateCredentialRefreshInputValidator, PublishCredentialRefreshInputValidator } =
+    await import('@learncard/types');
+const { activityRouter } = await import('../src/routes/activity');
+
+const activityInputs: Record<string, ZodType> = {
+    '/activity/credentials': activityRouter._def.procedures.getMyActivities._def.inputs.at(
+        -1
+    ) as ZodType,
+    '/activity/credentials/stats': activityRouter._def.procedures.getActivityStats._def.inputs.at(
+        -1
+    ) as ZodType,
+};
+const records: CapturedRequest[] = await Bun.file(capture).json();
+for (const record of records) {
+    const url = new URL(record.path, 'http://offline.invalid');
+    let valid: boolean;
+    if (url.pathname === '/credential-refresh/publish') {
+        valid = PublishCredentialRefreshInputValidator.safeParse(record.body).success;
+    } else if (url.pathname === '/credential-refresh/allocate') {
+        valid = AllocateCredentialRefreshInputValidator.safeParse(record.body).success;
+    } else {
+        const validator = activityInputs[url.pathname];
+        assert(validator, `No source validator for captured path ${url.pathname}`);
+        valid = validator.safeParse(Object.fromEntries(url.searchParams)).success;
+    }
+    assert.equal(
+        valid,
+        record.serverValid,
+        `Source contract rejected/accepted unexpected input: ${record.method} ${record.path}`
+    );
+}
+
+// The historical client format and offset suffixes must remain invalid server input.
+for (const validator of Object.values(activityInputs)) {
+    for (const date of [
+        '2026-01-02T03:04:05.000000+0000',
+        '2026-01-02T03:04:05+00:00',
+        '2026-01-02T03:04:05',
+    ]) {
+        for (const field of ['startDate', 'endDate']) {
+            assert.equal(
+                validator.safeParse({ [field]: date }).success,
+                false,
+                `Server unexpectedly accepts ${field}=${date}`
+            );
+        }
+    }
+}
+console.log(
+    `Verified ${records.length} captured publication/allocation/activity cases and Z-only boundaries against actual source validators`
+);
+process.exit(0);

package/serverless-local.yml

@@ -50,7 +50,9 @@ provider:
         INBOX_QUEUE_URL: ${env:INBOX_QUEUE_URL, ''}
         INBOX_QUEUE_ENDPOINT: ${env:INBOX_QUEUE_ENDPOINT, ''}
         PORT: ${env:PORT, 3000}
-        LAMBDA_STAGE: ${opt:stage, "dev"}
+        CONFIG_STAGE: ${env:CONFIG_STAGE, ''}
+        # serverless-offline sets AWS_LAMBDA_FUNCTION_NAME, so bootstrap reads LAMBDA_STAGE.
+        LAMBDA_STAGE: ${env:CONFIG_STAGE, ''}
         SEED: ${env:SEED}
         NEO4J_URI: ${env:NEO4J_URI}
         NEO4J_USERNAME: ${env:NEO4J_USERNAME}
@@ -61,17 +63,12 @@ provider:
             'Fn::GetAtt': [ElasticCacheCluster, RedisEndpoint.Port]
         NOTIFICATIONS_QUEUE_URL: ${construct:notifications-queue.queueUrl}
         SKILL_EMBEDDING_GOOGLE_API_KEY: ${env:SKILL_EMBEDDING_GOOGLE_API_KEY, ""}
-        SKILL_EMBEDDING_GOOGLE_MODEL: ${env:SKILL_EMBEDDING_GOOGLE_MODEL, "gemini-embedding-001"}
         SKILL_EMBEDDING_BATCH_SIZE: ${env:SKILL_EMBEDDING_BATCH_SIZE, "25"}
         SKILL_EMBEDDING_BACKFILL_ON_STARTUP: ${env:SKILL_EMBEDDING_BACKFILL_ON_STARTUP, "false"}
         SKILL_EMBEDDING_BACKFILL_LOCK_TTL_SECONDS: ${env:SKILL_EMBEDDING_BACKFILL_LOCK_TTL_SECONDS, "900"}
         SKILL_EMBEDDING_BACKFILL_PAGE_SIZE: ${env:SKILL_EMBEDDING_BACKFILL_PAGE_SIZE, "100"}
         SKILL_EMBEDDING_BACKFILL_BATCH_SIZE: ${env:SKILL_EMBEDDING_BACKFILL_BATCH_SIZE, "50"}
-        OIDC_TRUSTED_ISSUERS: ${env:OIDC_TRUSTED_ISSUERS, ""}
-        OIDC_EXPECTED_AUDIENCE: ${env:OIDC_EXPECTED_AUDIENCE, ""}
-        CREDENTIAL_REFRESH_ENABLED: ${env:CREDENTIAL_REFRESH_ENABLED, "false"}
         CREDENTIAL_REFRESH_DIGEST_SECRET: ${env:CREDENTIAL_REFRESH_DIGEST_SECRET, ""}
-        CREDENTIAL_REFRESH_NOTIFICATION_WINDOW_HOURS: ${env:CREDENTIAL_REFRESH_NOTIFICATION_WINDOW_HOURS, "24"}
     tracing:
         apiGateway: true
         lambda: true

package/serverless.function-env.cjs

@@ -0,0 +1,50 @@
+const { functionEnvironment, pickNonEmpty } = require('@learncard/service-config/function-env.cjs');
+
+// User-approved brain-service deployment credentials. In bundle mode these are delivered
+// through the runtime-secrets bundle and omitted here; in fallback mode (no bundle) the
+// existing per-value GitHub environment secrets are retained. Only genuine credentials
+// belong in this list — non-secret allowlists, tuning flags and per-stage values are
+// delivered through checked-in stage config at cold start, never forwarded here.
+const PROVIDER_SECRETS = [
+    'SEED',
+    'NEO4J_URI',
+    'NEO4J_USERNAME',
+    'NEO4J_PASSWORD',
+    'POSTMARK_API_KEY',
+    'MESSAGEBIRD_AUTH_TOKEN',
+    'SENTRY_DSN',
+    'POSTHOG_API_KEY',
+    'SKILL_EMBEDDING_GOOGLE_API_KEY',
+    'SKILLS_PROVIDER_API_KEY',
+    'TWILIO_ACCOUNT_SID',
+    'TWILIO_AUTH_TOKEN',
+    'SMART_RESUME_CLIENT_ID',
+    'SMART_RESUME_ACCESS_KEY',
+    'SMART_RESUME_CONTRACT_URI',
+    'CREDENTIAL_REFRESH_DIGEST_SECRET',
+    'SHARE_LINK_REQUEST_HASH_SECRET',
+    'APP_STORE_ADMIN_PROFILE_IDS',
+    'LOGIN_PROVIDER_DID',
+    'NOTIFICATIONS_SERVICE_WEBHOOK_URL',
+];
+
+// Serverless v3 supplies CLI options to file functions and recursively resolves the strings
+// it returns, so CloudFormation intrinsics (Fn::GetAtt) and construct references survive.
+// Every brain-service function shares the one generated execution role, so the bundle pointer
+// and the credential fallbacks sit together on the provider. Bundle mode emits only infra plus
+// the pointer; fallback mode retains the per-value GitHub secrets. Non-secret per-stage tuning
+// and allowlists are applied from checked-in stage config at cold start, never forwarded here.
+exports.provider = ({ options = {}, env = process.env } = {}) => ({
+    LAMBDA_STAGE: options.stage || 'dev',
+    // Non-secret product selector for the shared stage files (config.<tenant>.<stage>.json).
+    CONFIG_TENANT: env.CONFIG_TENANT || 'learncard',
+    PORT: String(options.httpPort || '3000'),
+    REDIS_HOST: { 'Fn::GetAtt': ['ElasticCacheCluster', 'RedisEndpoint.Address'] },
+    REDIS_PORT: { 'Fn::GetAtt': ['ElasticCacheCluster', 'RedisEndpoint.Port'] },
+    NOTIFICATIONS_QUEUE_URL: '${construct:notifications-queue.queueUrl}',
+    INBOX_QUEUE_URL: '${construct:inbox-queue.queueUrl}',
+    // The deploy commit, emitted only when set so an empty string never counts toward the
+    // 4KB per-function environment limit.
+    ...pickNonEmpty(['GIT_SHA'], env),
+    ...functionEnvironment({ always: ['RUNTIME_SECRETS_ID'], fallback: PROVIDER_SECRETS, env }),
+});

package/serverless.local.yml

@@ -64,7 +64,6 @@ provider:
             'Fn::GetAtt': [ElasticCacheCluster, RedisEndpoint.Address]
         REDIS_PORT:
             'Fn::GetAtt': [ElasticCacheCluster, RedisEndpoint.Port]
-        APP_BRAND: ${env:APP_BRAND, 'scouts'}
     tracing:
         apiGateway: true
         lambda: true