@learncard/network-brain-service 3.19.1 → 4.0.0

package/src/helpers/contract-requests.helpers.ts

@@ -0,0 +1,211 @@
+import { randomUUID } from 'node:crypto';
+import { BindParam, QueryBuilder } from 'neogma';
+import { TRPCError } from '@trpc/server';
+import type { SendContractRequest } from '@learncard/types';
+import {
+    getContractByUri,
+    getContractRequestAccess,
+    getStoredContractRequest,
+} from '@accesslayer/consentflowcontract/read';
+import { getProfileByProfileId } from '@accesslayer/profile/read';
+import { getWritersForContract } from '@accesslayer/consentflowcontract/relationships/read';
+import {
+    canReadContractData,
+    lockContractAudience,
+    runAudienceMutation,
+} from '@accesslayer/consentflowcontract/relationships/recipients';
+import { getProfileIdFromString } from './did.helpers';
+import { userHasRequiredScopes } from './auth-grant.helpers';
+import { enforceRateLimits } from './rateLimit.helpers';
+import { requestEventCypher, tryDispatchContractEvent } from './contract-events.helpers';
+import type { ProfileType } from 'types/profile';
+import type { DbContractType } from 'types/consentflowcontract';
+
+/** Resolve shared request inputs without granting writers access to consented data. */
+export const resolveContractRequest = async (
+    contractUri: string,
+    targetIdentifier: string,
+    profile: ProfileType,
+    domain: string,
+    allowRecipients = true
+): Promise<{ contract: DbContractType; target: ProfileType }> => {
+    const contract = await getContractByUri(contractUri);
+    if (!contract) throw new TRPCError({ code: 'NOT_FOUND', message: 'Contract not found' });
+    if (!(await canManageContractRequests(contract, profile.profileId, allowRecipients)))
+        throw new TRPCError({
+            code: 'UNAUTHORIZED',
+            message: 'You do not have permission to send requests for this contract.',
+        });
+    const targetId = await getProfileIdFromString(targetIdentifier, domain);
+    const target = targetId ? await getProfileByProfileId(targetId) : null;
+    if (!target) throw new TRPCError({ code: 'NOT_FOUND', message: 'Target profile not found' });
+    return { contract, target };
+};
+
+export const canManageContractRequests = async (
+    contract: DbContractType,
+    profileId: string,
+    allowRecipients = false
+): Promise<boolean> => {
+    const access = await getContractRequestAccess(contract.id, profileId);
+    return access.isManager || (allowRecipients && access.isRecipient);
+};
+
+/** One request per contract/target in v1. Exact pending retries do not create another event. */
+export const sendGenericContractRequest = async (
+    input: SendContractRequest,
+    profile: ProfileType,
+    domain: string
+): Promise<boolean> => {
+    const { contract, target } = await resolveContractRequest(
+        input.contractUri,
+        input.targetProfileId,
+        profile,
+        domain
+    );
+    if (target.profileId === profile.profileId)
+        throw new TRPCError({
+            code: 'BAD_REQUEST',
+            message: 'You cannot send a request to yourself.',
+        });
+    await enforceRateLimits([
+        {
+            key: `contract-request-rate:${contract.id}:${profile.profileId}`,
+            limit: 500,
+            windowSeconds: 3600,
+            description: '500 contract requests per hour',
+        },
+    ]);
+    const requestId = randomUUID();
+    const query = lockContractAudience(
+        new QueryBuilder(
+            new BindParam({
+                targetProfileId: target.profileId,
+                senderProfileId: profile.profileId,
+                requestId,
+                externalReferenceId: input.externalReferenceId ?? null,
+                message: input.message ?? null,
+                now: new Date().toISOString(),
+                domain,
+                eventFrom: profile.profileId,
+                eventKind: 'request_sent',
+            })
+        ),
+        contract.id
+    ).raw(`
+        MATCH (target:Profile {profileId: $targetProfileId})
+        WITH contract, target WHERE $targetProfileId <> $senderProfileId AND EXISTS {
+            MATCH (contract)-[:CREATED_BY|CAN_WRITE|SHARES_DATA_WITH]->(:Profile {profileId: $senderProfileId})
+        } AND CASE WHEN contract.expiresAt IS NULL OR trim(contract.expiresAt) = '' THEN true ELSE datetime(contract.expiresAt) > datetime($now) END
+        AND NOT EXISTS {
+            MATCH (target)-[:CREATED_BY]->(terms:ConsentFlowTerms)-[:CONSENTS_TO]->(contract)
+            WHERE (terms.status = 'live' OR (terms.status = 'stale' AND terms.oneTime = true)) AND
+                CASE WHEN terms.expiresAt IS NULL OR trim(terms.expiresAt) = '' THEN true ELSE datetime(terms.expiresAt) > datetime($now) END
+        }
+        OPTIONAL MATCH (contract)-[existing:REQUESTED_FOR]->(target)
+        WITH contract, target, existing WHERE existing IS NULL OR
+            (existing.status = 'pending' AND existing.requestId IS NOT NULL AND
+                existing.requestedBy = $senderProfileId AND
+                coalesce(existing.externalReferenceId, '') = coalesce($externalReferenceId, '') AND
+                coalesce(existing.message, '') = coalesce($message, ''))
+        MERGE (contract)-[request:REQUESTED_FOR]->(target)
+        ON CREATE SET request += {requestId: $requestId, requestedBy: $senderProfileId,
+            externalReferenceId: $externalReferenceId, message: $message,
+            requestedAt: $now, status: 'pending', readStatus: 'unseen'}
+        ${requestEventCypher}
+    `);
+    const result = await runAudienceMutation(query);
+    if (!result.records.length)
+        throw new TRPCError({
+            code: 'CONFLICT',
+            message:
+                'Active consent or a conflicting/terminal request already exists, or the contract changed.',
+        });
+    await tryDispatchContractEvent(result.records[0]!.get('eventId'));
+    return true;
+};
+
+/** Target-only denial; cancellation also permits owner/writers and the requesting recipient. */
+export const decideGenericContractRequest = async ({
+    contract,
+    targetProfileId,
+    actorProfileId,
+    status,
+    domain,
+}: {
+    contract: DbContractType;
+    targetProfileId: string;
+    actorProfileId: string;
+    status: 'denied' | 'cancelled';
+    domain: string;
+}): Promise<boolean> => {
+    const request = await getStoredContractRequest(contract.id, targetProfileId);
+    if (!request?.requestId)
+        throw new TRPCError({ code: 'NOT_FOUND', message: 'Contract request not found' });
+    const isTarget = actorProfileId === targetProfileId;
+    const writers = await getWritersForContract(contract);
+    const authorized =
+        isTarget ||
+        (status === 'cancelled' &&
+            (writers.some(profile => profile.profileId === actorProfileId) ||
+                (request.requestedBy === actorProfileId &&
+                    (await canReadContractData(contract.id, actorProfileId)))));
+    if (!authorized)
+        throw new TRPCError({ code: 'UNAUTHORIZED', message: 'You cannot change this request' });
+    const result = await runAudienceMutation(
+        lockContractAudience(
+            new QueryBuilder(
+                new BindParam({
+                    targetProfileId,
+                    actorProfileId,
+                    status,
+                    domain,
+                    now: new Date().toISOString(),
+                    eventKind: status === 'denied' ? 'request_denied' : 'request_cancelled',
+                    eventFrom: actorProfileId,
+                })
+            ),
+            contract.id
+        ).raw(`
+        MATCH (contract)-[request:REQUESTED_FOR]->(target:Profile {profileId: $targetProfileId})
+        WHERE request.requestId IS NOT NULL AND request.status IN ['pending', $status]
+            AND ($actorProfileId = $targetProfileId OR ($status = 'cancelled' AND
+                (EXISTS { MATCH (contract)-[:CREATED_BY|CAN_WRITE]->(:Profile {profileId: $actorProfileId}) } OR
+                 (request.requestedBy = $actorProfileId AND EXISTS {
+                    MATCH (contract)-[:SHARES_DATA_WITH]->(:Profile {profileId: $actorProfileId}) }))))
+        SET request.status = $status
+        ${requestEventCypher}
+    `)
+    );
+    if (!result.records.length)
+        throw new TRPCError({
+            code: 'CONFLICT',
+            message: 'Request already decided or permission changed',
+        });
+    await tryDispatchContractEvent(result.records[0]!.get('eventId'));
+    return true;
+};
+
+export const markGenericContractRequestSeen = async (
+    contractId: string,
+    targetProfileId: string
+): Promise<boolean> => {
+    const result = await runAudienceMutation(
+        lockContractAudience(new QueryBuilder(new BindParam({ targetProfileId })), contractId)
+            .raw(`MATCH (contract)-[request:REQUESTED_FOR]->(:Profile {profileId: $targetProfileId})
+            WHERE request.requestId IS NOT NULL
+            SET request.readStatus = 'seen' RETURN request`)
+    );
+    if (!result.records.length)
+        throw new TRPCError({ code: 'NOT_FOUND', message: 'Request not found' });
+    return true;
+};
+
+/** Legacy request mutations retain their scope behavior; attributed requests require write. */
+export const assertGenericRequestWriteScope = (scope?: string): void => {
+    if (!userHasRequiredScopes(scope ?? '', 'contracts:write'))
+        throw new TRPCError({
+            code: 'UNAUTHORIZED',
+            message: 'This operation requires contracts:write scope',
+        });
+};

package/src/helpers/finalize-inbox.helpers.ts

@@ -3,7 +3,11 @@ import {
     LCNNotificationTypeEnumValidator,
     LCNInboxStatusEnumValidator,
     VC,
+    JWE,
     UnsignedVC,
+    VCValidator,
+    JWEValidator,
+    InboxCredentialType,
 } from '@learncard/types';
 import { ProfileType } from 'types/profile';
 import { getContactMethodsForProfile } from '@accesslayer/contact-method/read';
@@ -21,6 +25,113 @@ import { getLearnCard, getEmptyLearnCard } from '@helpers/learnCard.helpers';
 import { logCredentialClaimed, logCredentialFailed } from '@helpers/activity.helpers';
 import { handleConnectionPromptsForCredentialClaim } from '@helpers/connectionPrompt.helpers';
 import { decryptInboxCredential } from '@helpers/inbox-encryption.helpers';
+import { setCredentialSubjectIds } from '@helpers/credentialSubject.helpers';
+import { getBitstringStatusListEntries } from '@learncard/helpers';
+import type { IssuedCredential } from 'types/credential';
+import { getBoostByUri } from '@accesslayer/boost/read';
+import { storeCredential } from '@accesslayer/credential/create';
+import { createBoostInstanceOfRelationship } from '@accesslayer/boost/relationships/create';
+import {
+    createSentCredentialRelationship,
+    createReceivedCredentialRelationship,
+    setDefaultClaimedRole,
+} from '@accesslayer/credential/relationships/create';
+import { neogma } from '@instance';
+import { processClaimHooks } from '@helpers/claim-hooks.helpers';
+import { clearDidWebCacheForChildProfileManagers } from '@accesslayer/boost/relationships/update';
+
+/** Graph-only completion: a failed write retains pending escrow for the next attempt. */
+const finalizeAcceptedDelivery = async (
+    inboxCredential: InboxCredentialType,
+    issued: IssuedCredential,
+    recipient: ProfileType,
+    sender: ProfileType
+): Promise<boolean> => {
+    const boost = inboxCredential.boostUri
+        ? await getBoostByUri(inboxCredential.boostUri)
+        : undefined;
+    const session = neogma.driver.session();
+    const transaction = session.beginTransaction({ timeout: 30_000 });
+    // Signing and status-index allocation happen before this bounded graph transaction;
+    // a retry or lost claim race may leave unused indices, intentionally, rather than
+    // hold Neo4j locks across external signing.
+    try {
+        const finalized = await finalizeAndWipeInboxCredential(
+            inboxCredential.id,
+            { recipientDid: recipient.did, credential: JWEValidator.parse(issued.credential) },
+            {},
+            transaction
+        );
+        if (!finalized) {
+            // Another claim or expiry won the lock. It is not a new issuance failure.
+            await transaction.rollback();
+            return false;
+        }
+        const instance = await storeCredential(issued, transaction);
+        if (boost) await createBoostInstanceOfRelationship(instance, boost, transaction);
+        await createSentCredentialRelationship(
+            { type: 'profile', profile: sender },
+            recipient,
+            instance,
+            undefined,
+            inboxCredential.activityId,
+            inboxCredential.integrationId,
+            transaction
+        );
+        await createReceivedCredentialRelationship(
+            recipient,
+            sender,
+            instance,
+            undefined,
+            transaction
+        );
+        await processClaimHooks(recipient, instance, transaction);
+        await setDefaultClaimedRole(recipient, instance, transaction);
+        if (
+            !(await createClaimedRelationship(
+                recipient.profileId,
+                inboxCredential.id,
+                'finalize',
+                transaction
+            ))
+        ) {
+            throw new Error('Inbox claim recipient no longer exists');
+        }
+        await transaction.commit();
+    } catch (error) {
+        await transaction
+            .rollback()
+            .catch(rollbackError =>
+                console.error(
+                    'Failed to roll back inbox finalization',
+                    inboxCredential.id,
+                    rollbackError
+                )
+            );
+        throw error;
+    } finally {
+        // Closing the session cannot turn a committed delivery into a pending failure.
+        await session
+            .close()
+            .catch(error =>
+                console.error(
+                    'Failed to close inbox finalization session',
+                    inboxCredential.id,
+                    error
+                )
+            );
+    }
+    if (boost) {
+        await clearDidWebCacheForChildProfileManagers(boost.id).catch(error =>
+            console.error(
+                'Could not clear did:web cache after inbox claim',
+                inboxCredential.id,
+                error
+            )
+        );
+    }
+    return true;
+};
 
 export async function finalizeInboxCredentialsForProfile(
     profile: ProfileType,
@@ -30,8 +141,8 @@ export async function finalizeInboxCredentialsForProfile(
     claimed: number;
     errors: number;
     guardianPending: number;
-    verifiableCredentials: VC[];
-    deliveries: { id: string; credential: VC }[];
+    verifiableCredentials: (VC | JWE)[];
+    deliveries: { id: string; credential: VC | JWE }[];
 }> {
     const contactMethods = await getContactMethodsForProfile(profile.did);
     const verifiedContacts = contactMethods.filter(cm => cm.isVerified);
@@ -48,8 +159,8 @@ export async function finalizeInboxCredentialsForProfile(
         lcDid = lc.id.did();
     } catch {}
 
-    const verifiableCredentials: VC[] = [];
-    const deliveries: { id: string; credential: VC }[] = [];
+    const verifiableCredentials: (VC | JWE)[] = [];
+    const deliveries: { id: string; credential: VC | JWE }[] = [];
 
     for (const cm of verifiedContacts) {
         const pending = await getAcceptedPendingInboxCredentialsForContactMethodId(cm.id);
@@ -79,7 +190,8 @@ export async function finalizeInboxCredentialsForProfile(
             }
 
             try {
-                let finalCredential: VC;
+                let finalCredential: VC | JWE;
+                let issued: IssuedCredential | undefined;
                 const credentialPayload = inboxCredential.refreshId
                     ? undefined
                     : await decryptInboxCredential(inboxCredential.credential);
@@ -102,29 +214,16 @@ export async function finalizeInboxCredentialsForProfile(
                     if (!endpoint || !name)
                         throw new Error('Inbox credential missing signing authority info');
 
-                    const issuerProfile = await getProfileByDid(inboxCredential.issuerDid);
-                    if (!issuerProfile) throw new Error('Issuer profile not found');
+                    if (!senderProfile) throw new Error('Issuer profile not found');
 
                     const signingAuthorityForUser = await getSigningAuthorityForUserByName(
-                        issuerProfile,
+                        senderProfile,
                         endpoint,
                         name
                     );
                     if (!signingAuthorityForUser) throw new Error('Signing authority not found');
 
-                    // Set subject DID to the authenticated user's DID
-                    if (Array.isArray(unsignedCredential.credentialSubject)) {
-                        unsignedCredential.credentialSubject =
-                            unsignedCredential.credentialSubject.map(sub => ({
-                                ...sub,
-                                id: (sub as any).did || (sub as any).id || profile.did,
-                            }));
-                    } else {
-                        (unsignedCredential.credentialSubject as any).id =
-                            (unsignedCredential as any).credentialSubject?.did ||
-                            (unsignedCredential as any).credentialSubject?.id ||
-                            profile.did;
-                    }
+                    setCredentialSubjectIds(unsignedCredential, profile.did);
 
                     // Set issuer from signing authority
                     unsignedCredential.issuer = signingAuthorityForUser.relationship.did;
@@ -136,36 +235,56 @@ export async function finalizeInboxCredentialsForProfile(
                         ? getAppDidWeb(domain, listingSlug)
                         : undefined;
 
-                    finalCredential = (
-                        await issueCredentialWithSigningAuthority(
-                            { type: 'profile', profile: issuerProfile },
-                            unsignedCredential,
-                            signingAuthorityForUser,
-                            domain,
-                            false,
-                            ownerDidOverride
-                        )
-                    ).credential as VC;
+                    issued = await issueCredentialWithSigningAuthority(
+                        { type: 'profile', profile: senderProfile },
+                        unsignedCredential,
+                        signingAuthorityForUser,
+                        domain,
+                        undefined,
+                        ownerDidOverride,
+                        undefined,
+                        // Preserve issuer did:key access alongside the managed/app did:web reader.
+                        [senderProfile.did]
+                    );
+                    finalCredential = issued.credential;
                 } else {
                     finalCredential = JSON.parse(credentialPayload!) as VC;
                 }
 
                 if (!inboxCredential.refreshId) {
-                    // The seeded encryption plugin adds the service DID; use explicit recipients.
-                    const learnCard = await getEmptyLearnCard();
-                    const recoveryCredential = await learnCard.invoke.createDagJwe(
-                        finalCredential,
-                        [profile.did]
-                    );
-                    const finalized = await finalizeAndWipeInboxCredential(inboxCredential.id, {
-                        recipientDid: profile.did,
-                        credential: recoveryCredential,
-                    });
-                    if (!finalized) throw new Error('Inbox credential is no longer pending');
+                    if (!senderProfile) throw new Error('Issuer profile not found');
+                    if (!issued) {
+                        const signedCredential = VCValidator.parse(finalCredential);
+                        const learnCard = await getEmptyLearnCard();
+                        issued = {
+                            kind: 'issued-credential',
+                            credential: await learnCard.invoke.createDagJwe(signedCredential, [
+                                profile.did,
+                                inboxCredential.issuerDid,
+                            ]),
+                            statusEntries: getBitstringStatusListEntries(signedCredential),
+                        };
+                    }
+                    if (
+                        !(await finalizeAcceptedDelivery(
+                            inboxCredential,
+                            issued,
+                            profile,
+                            senderProfile
+                        ))
+                    )
+                        continue;
+                    finalCredential = issued.credential;
                 }
 
-                // Only write a claim audit edge once the record is actually finalized.
-                await createClaimedRelationship(profile.profileId, inboxCredential.id, 'finalize');
+                // Managed refresh retains its separate lifecycle; ordinary claims audit in the transaction.
+                if (inboxCredential.refreshId) {
+                    await createClaimedRelationship(
+                        profile.profileId,
+                        inboxCredential.id,
+                        'finalize'
+                    );
+                }
 
                 if (
                     senderProfile &&

package/src/helpers/inbox.helpers.ts

@@ -28,6 +28,7 @@ import {
 
 import { ProfileType, SigningAuthorityForUserType } from 'types/profile';
 import type { IssuedCredential } from 'types/credential';
+import { setCredentialSubjectIds } from '@helpers/credentialSubject.helpers';
 import { getBitstringStatusListEntries } from '@learncard/helpers';
 import { createInboxCredential } from '@accesslayer/inbox-credential/create';
 import { Context } from '@routes';
@@ -111,51 +112,48 @@ export const claimIntoInbox = async (
     );
 
     if (existingProfile) {
-        // Auto-deliver to existing user
-        let finalCredential: VC;
-
+        let issued: IssuedCredential;
         if (isSigned) {
-            finalCredential = credential as VC;
+            const signedCredential = credential as VC;
+            const learnCard = await getEmptyLearnCard();
+            issued = {
+                kind: 'issued-credential',
+                credential: await learnCard.invoke.createDagJwe(signedCredential, [
+                    existingProfile.did,
+                    issuerProfile.did,
+                ]),
+                statusEntries: getBitstringStatusListEntries(signedCredential),
+            };
         } else {
-            // For app-based SAs (listings), use the app did:web as ownerDid
+            const unsignedCredential = credential as UnsignedVC;
+            setCredentialSubjectIds(unsignedCredential, existingProfile.did);
+            // Listings sign as the app, but the issuing profile must remain a reader.
             const ownerDidOverride = listingSlug
                 ? getAppDidWeb(ctx.domain, listingSlug)
                 : undefined;
-
-            finalCredential = (
-                await issueCredentialWithSigningAuthority(
-                    { type: 'profile', profile: issuerProfile },
-                    credential as UnsignedVC,
-                    signingAuthorityForUser,
-                    ctx.domain,
-                    false, // don't encrypt
-                    ownerDidOverride
-                )
-            ).credential as VC;
+            issued = await issueCredentialWithSigningAuthority(
+                { type: 'profile', profile: issuerProfile },
+                unsignedCredential,
+                signingAuthorityForUser,
+                ctx.domain,
+                undefined,
+                ownerDidOverride,
+                undefined,
+                [issuerProfile.did]
+            );
         }
-
-        // Use the explicit-recipient API; the seeded encryption plugin also adds the service DID.
-        const learnCard = await getEmptyLearnCard();
-        const encryptedDelivery = await learnCard.invoke.createDagJwe(finalCredential, [
-            existingProfile.did,
-            issuerProfile.did,
-        ]);
         await sendCredential(
             issuerProfile,
             existingProfile,
-            {
-                kind: 'issued-credential',
-                credential: encryptedDelivery,
-                statusEntries: getBitstringStatusListEntries(finalCredential),
-            },
+            issued,
             ctx.domain,
             undefined,
             activityId,
             integrationId
         );
-        // Record successful delivery without creating temporary service-readable escrow.
         const finalizedInboxCredential = await createInboxCredential({
-            credential: JSON.stringify(finalCredential),
+            // Delivered audit rows never retain a credential payload.
+            credential: '',
             isSigned: true,
             delivered: true,
             isAccepted: true,
@@ -166,7 +164,6 @@ export const claimIntoInbox = async (
             activityId,
             expiresInDays,
         });
-
         return {
             status: LCNInboxStatusEnumValidator.enum.ISSUED,
             inboxCredential: finalizedInboxCredential,
@@ -333,50 +330,39 @@ export const issueToInbox = async (
     const recipientIsManaged = recipientManagers.length > 0;
 
     if (existingProfile && !guardianEmail && !recipientIsManaged && !configuration.refresh) {
-        // Auto-deliver to existing user
-        let finalCredential: VC;
-
+        let issued: IssuedCredential;
         if (isSigned) {
-            finalCredential = credential as VC;
+            const signedCredential = credential as VC;
+            const learnCard = await getEmptyLearnCard();
+            issued = {
+                kind: 'issued-credential',
+                credential: await learnCard.invoke.createDagJwe(signedCredential, [
+                    existingProfile.did,
+                    issuerProfile.did,
+                ]),
+                statusEntries: getBitstringStatusListEntries(signedCredential),
+            };
         } else {
-            // Sign the credential using signing authority
             const signingAuthorityForUser = await getSigningAuthorityForUserByName(
                 issuerProfile,
                 signingAuthority!.endpoint,
                 signingAuthority!.name
             );
-
             if (!signingAuthorityForUser) {
                 throw new InboxIssuancePreflightError({
                     code: 'NOT_FOUND',
                     message: 'Signing authority not found for issuer',
                 });
             }
-
-            finalCredential = (
-                await issueCredentialWithSigningAuthority(
-                    { type: 'profile', profile: issuerProfile },
-                    credential as UnsignedVC,
-                    signingAuthorityForUser,
-                    ctx.domain,
-                    false // don't encrypt
-                )
-            ).credential as VC;
+            const unsignedCredential = credential as UnsignedVC;
+            setCredentialSubjectIds(unsignedCredential, existingProfile.did);
+            issued = await issueCredentialWithSigningAuthority(
+                { type: 'profile', profile: issuerProfile },
+                unsignedCredential,
+                signingAuthorityForUser,
+                ctx.domain
+            );
         }
-
-        // Send credential using appropriate helper (sendBoost handles boost tracking)
-        // Pass activityId and integrationId so they're stored on the relationship for CLAIMED chaining
-        const learnCard = await getEmptyLearnCard();
-        const encryptedDelivery = await learnCard.invoke.createDagJwe(finalCredential, [
-            existingProfile.did,
-            issuerProfile.did,
-        ]);
-        // Carry only public status coordinates alongside the newly encrypted payload.
-        const delivery: IssuedCredential = {
-            kind: 'issued-credential',
-            credential: encryptedDelivery,
-            statusEntries: getBitstringStatusListEntries(finalCredential),
-        };
         const boost = boostUri ? await getBoostByUri(boostUri) : undefined;
         await checkpointDelivery();
         if (boostUri && boost) {
@@ -384,27 +370,26 @@ export const issueToInbox = async (
                 from: { type: 'profile', profile: issuerProfile },
                 to: existingProfile,
                 boost,
-                credential: delivery,
+                credential: issued,
                 domain: ctx.domain,
                 activityId,
                 integrationId,
             });
         } else {
-            // Fall back to ordinary delivery when no boost exists for the supplied URI.
             await sendCredential(
                 issuerProfile,
                 existingProfile,
-                delivery,
+                issued,
                 ctx.domain,
                 undefined,
                 activityId,
                 integrationId
             );
         }
-
         // Record successful delivery without creating temporary service-readable escrow.
         const finalizedInboxCredential = await createInboxCredential({
-            credential: JSON.stringify(finalCredential),
+            // Delivered audit rows never retain a credential payload.
+            credential: '',
             isSigned: true,
             delivered: true,
             recipient,