@learncard/network-brain-service 3.19.1 → 4.0.1

package/lambda.ts

@@ -1,203 +1,57 @@
-import serverlessHttp from 'serverless-http';
-import type {
-    Context,
-    APIGatewayProxyResultV2,
-    APIGatewayProxyEventV2,
-    SQSBatchResponse,
-    SQSHandler,
-} from 'aws-lambda';
-import { awsLambdaRequestHandler } from '@trpc/server/adapters/aws-lambda';
-import * as Sentry from '@sentry/serverless';
-
-import app from './src/openapi';
-import skillsViewerApp from './src/skills-viewer';
-import statusListsApp from './src/status-lists';
-import credentialRefreshApp from './src/credential-refresh';
-import { appRouter, createContext } from './src/app';
-import { publicShareLinkCacheControlHeaders } from './src/routes';
-import { deliverQueuedNotification } from './src/helpers/notificationQueue.helpers';
-import { startSkillEmbeddingBackfill } from './src/helpers/skill-embedding.helpers';
-import { createOpenApiAwsLambdaHandler } from './src/helpers/shim';
-import {
-    handleTrpcError,
-    sentryBeforeSend,
-    getTracesSampleRate,
-} from './src/helpers/sentry.helpers';
-import { environment } from './src/config/environment';
-import { toServerlessApplication } from './src/helpers/serverlessApplication';
-import { runInboxMaintenance } from './src/helpers/inbox-maintenance.helpers';
-import {
-    inboxBatchResponseMeta,
-    withInboxBatchBodyLimit,
-} from './src/helpers/inbox-batch-http.helpers';
-
-Sentry.AWSLambda.init({
-    dsn: environment.SENTRY_DSN,
-    environment: environment.SENTRY_ENV,
-    enabled: Boolean(environment.SENTRY_DSN),
-    tracesSampleRate: getTracesSampleRate(),
-    beforeSend: sentryBeforeSend,
-    integrations: [
-        new Sentry.Integrations.Console(),
-        new Sentry.Integrations.Http({ tracing: true }),
-        new Sentry.Integrations.ContextLines(),
-    ],
-});
+import { bootstrapLambda } from '@learncard/service-config';
 
-startSkillEmbeddingBackfill().catch(err =>
-    console.error('Skill embedding backfill startup error:', err)
-);
+import { base, stages } from './src/config/stageConfig';
 
-export const swaggerUiHandler = serverlessHttp(toServerlessApplication(app), {
-    basePath: '/docs',
-});
+type LambdaApp = typeof import('./lambdaApp');
 
-export const skillsViewerHandler = serverlessHttp(toServerlessApplication(skillsViewerApp));
-
-export const statusListsHandler = serverlessHttp(toServerlessApplication(statusListsApp));
-
-// Passing the Fastify instance selects serverless-http's inject adapter, which
-// drops the API Gateway source address. The HTTP server path preserves it.
-const credentialRefreshProxy = serverlessHttp(toServerlessApplication(credentialRefreshApp.server));
-export const credentialRefreshHandler: typeof credentialRefreshProxy = async (event, context) => {
-    await credentialRefreshApp.ready();
-    return credentialRefreshProxy(event, context);
-};
-
-export const _openApiHandler = createOpenApiAwsLambdaHandler({
-    router: appRouter,
-    responseMeta: meta => {
-        return {
-            ...inboxBatchResponseMeta(meta),
-            headers: {
-                'Access-Control-Allow-Origin': '*',
-                'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
-                'Access-Control-Allow-Headers': 'Authorization, Content-Type',
-                ...publicShareLinkCacheControlHeaders(meta.paths),
-            },
-        };
-    },
-    createContext,
-    onError: handleTrpcError,
+const getApplication = bootstrapLambda<LambdaApp>({
+    base,
+    stages,
+    stage: process.env.AWS_LAMBDA_FUNCTION_NAME
+        ? process.env.LAMBDA_STAGE
+        : process.env.CONFIG_STAGE,
+    importApp: () => import('./lambdaApp'),
 });
 
-export const _trpcHandler = withInboxBatchBodyLimit(
-    awsLambdaRequestHandler({
-        allowMethodOverride: true,
-        router: appRouter,
-        createContext,
-        onError: handleTrpcError,
-        responseMeta: ({ paths }) => {
-            return {
-                headers: {
-                    'Access-Control-Allow-Origin': '*',
-                    'Access-Control-Allow-Methods': '*',
-                    'Access-Control-Allow-Headers': 'authorization',
-                    ...publicShareLinkCacheControlHeaders(paths),
-                },
-            };
-        },
-    }),
-    'trpc'
-);
-
-export const openApiHandler = Sentry.AWSLambda.wrapHandler(
-    async (event: APIGatewayProxyEventV2, context: Context): Promise<APIGatewayProxyResultV2> => {
-        if (event.requestContext.http.method === 'OPTIONS') {
-            return {
-                statusCode: 204,
-                headers: {
-                    'Access-Control-Allow-Origin': '*',
-                    'Access-Control-Allow-Headers': 'Authorization, Content-Type',
-                    'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
-                },
-            };
-        }
-
-        return _openApiHandler(event, context);
-    }
-);
-
-export const trpcHandler = Sentry.AWSLambda.wrapHandler(
-    async (event: APIGatewayProxyEventV2, context: Context): Promise<APIGatewayProxyResultV2> => {
-        if (event.requestContext.http.method === 'OPTIONS') {
-            return {
-                statusCode: 200,
-                headers: {
-                    'Access-Control-Allow-Origin': '*',
-                    'Access-Control-Allow-Headers': '*',
-                    'Access-Control-Allow-Methods': '*',
-                },
-            };
-        }
-
-        return _trpcHandler(event, context);
-    }
-);
-
-export const inboxQueueWorker: SQSHandler = Sentry.AWSLambda.wrapHandler(async event => {
-    const { processInboxQueueMessage } = await import('./src/helpers/inbox-queue.helpers');
-    const batchItemFailures = [];
-    for (const record of event.Records) {
-        try {
-            await processInboxQueueMessage(record.body);
-        } catch {
-            console.error('Inbox worker message failed', { messageId: record.messageId });
-            batchItemFailures.push({ itemIdentifier: record.messageId });
-        }
-    }
-    return { batchItemFailures } satisfies SQSBatchResponse;
-});
+export const trpcHandler = async (...args: Parameters<LambdaApp['trpcHandler']>) =>
+    (await getApplication()).trpcHandler(...args);
 
-export const inboxQueueDispatcher = Sentry.AWSLambda.wrapHandler(
-    async (_event: unknown, context: Context): Promise<void> => {
-        const { dispatchInboxJobs } = await import('./src/helpers/inbox-queue.helpers');
-        // Share one clock across publication and recovery, retaining five seconds for shutdown.
-        const deadline = Date.now() + Math.max(0, context.getRemainingTimeInMillis() - 5_000);
-        await dispatchInboxJobs(deadline);
-    }
-);
-
-export const inboxDeadLetterWorker: SQSHandler = Sentry.AWSLambda.wrapHandler(async event => {
-    const { processInboxDeadLetter } = await import('./src/helpers/inbox-queue.helpers');
-    const batchItemFailures = [];
-    for (const record of event.Records) {
-        try {
-            await processInboxDeadLetter(record.body);
-        } catch {
-            console.error('Inbox dead-letter processing failed', { messageId: record.messageId });
-            batchItemFailures.push({ itemIdentifier: record.messageId });
-        }
-    }
-    return { batchItemFailures } satisfies SQSBatchResponse;
-});
+export const openApiHandler = async (...args: Parameters<LambdaApp['openApiHandler']>) =>
+    (await getApplication()).openApiHandler(...args);
 
-export const notificationsWorker: SQSHandler = Sentry.AWSLambda.wrapHandler(async event => {
-    const batchItemFailures = await Promise.all(
-        event.Records.map(async record => {
-            try {
-                await deliverQueuedNotification(record.body);
-
-                return undefined;
-            } catch (error) {
-                console.error('Notification queue record failed', {
-                    messageId: record.messageId,
-                    error,
-                });
-
-                return { itemIdentifier: record.messageId };
-            }
-        })
-    );
-
-    return {
-        batchItemFailures: batchItemFailures.filter(
-            (failure): failure is { itemIdentifier: string } => failure !== undefined
-        ),
-    } satisfies SQSBatchResponse;
-});
+export const _trpcHandler = async (...args: Parameters<LambdaApp['_trpcHandler']>) =>
+    (await getApplication())._trpcHandler(...args);
 
-export const inboxMaintenanceHandler = Sentry.AWSLambda.wrapHandler(async (): Promise<void> => {
-    const counts = await runInboxMaintenance();
-    console.log('Universal Inbox maintenance completed', counts);
-});
+export const _openApiHandler = async (...args: Parameters<LambdaApp['_openApiHandler']>) =>
+    (await getApplication())._openApiHandler(...args);
+
+export const swaggerUiHandler = async (...args: Parameters<LambdaApp['swaggerUiHandler']>) =>
+    (await getApplication()).swaggerUiHandler(...args);
+
+export const skillsViewerHandler = async (...args: Parameters<LambdaApp['skillsViewerHandler']>) =>
+    (await getApplication()).skillsViewerHandler(...args);
+
+export const statusListsHandler = async (...args: Parameters<LambdaApp['statusListsHandler']>) =>
+    (await getApplication()).statusListsHandler(...args);
+
+export const credentialRefreshHandler = async (
+    ...args: Parameters<LambdaApp['credentialRefreshHandler']>
+) => (await getApplication()).credentialRefreshHandler(...args);
+
+export const inboxQueueWorker = async (...args: Parameters<LambdaApp['inboxQueueWorker']>) =>
+    (await getApplication()).inboxQueueWorker(...args);
+
+export const inboxQueueDispatcher = async (
+    ...args: Parameters<LambdaApp['inboxQueueDispatcher']>
+) => (await getApplication()).inboxQueueDispatcher(...args);
+
+export const inboxDeadLetterWorker = async (
+    ...args: Parameters<LambdaApp['inboxDeadLetterWorker']>
+) => (await getApplication()).inboxDeadLetterWorker(...args);
+
+export const notificationsWorker = async (...args: Parameters<LambdaApp['notificationsWorker']>) =>
+    (await getApplication()).notificationsWorker(...args);
+
+export const inboxMaintenanceHandler = async (
+    ...args: Parameters<LambdaApp['inboxMaintenanceHandler']>
+) => (await getApplication()).inboxMaintenanceHandler(...args);

package/lambdaApp.ts

@@ -0,0 +1,203 @@
+import serverlessHttp from 'serverless-http';
+import type {
+    Context,
+    APIGatewayProxyResultV2,
+    APIGatewayProxyEventV2,
+    SQSBatchResponse,
+    SQSHandler,
+} from 'aws-lambda';
+import { awsLambdaRequestHandler } from '@trpc/server/adapters/aws-lambda';
+import * as Sentry from '@sentry/serverless';
+
+import app from './src/openapi';
+import skillsViewerApp from './src/skills-viewer';
+import statusListsApp from './src/status-lists';
+import credentialRefreshApp from './src/credential-refresh';
+import { appRouter, createContext } from './src/app';
+import { publicShareLinkCacheControlHeaders } from './src/routes';
+import { deliverQueuedNotification } from './src/helpers/notificationQueue.helpers';
+import { startSkillEmbeddingBackfill } from './src/helpers/skill-embedding.helpers';
+import { createOpenApiAwsLambdaHandler } from './src/helpers/shim';
+import {
+    handleTrpcError,
+    sentryBeforeSend,
+    getTracesSampleRate,
+} from './src/helpers/sentry.helpers';
+import { environment } from './src/config/environment';
+import { toServerlessApplication } from './src/helpers/serverlessApplication';
+import { runInboxMaintenance } from './src/helpers/inbox-maintenance.helpers';
+import {
+    inboxBatchResponseMeta,
+    withInboxBatchBodyLimit,
+} from './src/helpers/inbox-batch-http.helpers';
+
+Sentry.AWSLambda.init({
+    dsn: environment.SENTRY_DSN,
+    environment: environment.SENTRY_ENV,
+    enabled: Boolean(environment.SENTRY_DSN),
+    tracesSampleRate: getTracesSampleRate(),
+    beforeSend: sentryBeforeSend,
+    integrations: [
+        new Sentry.Integrations.Console(),
+        new Sentry.Integrations.Http({ tracing: true }),
+        new Sentry.Integrations.ContextLines(),
+    ],
+});
+
+startSkillEmbeddingBackfill().catch(err =>
+    console.error('Skill embedding backfill startup error:', err)
+);
+
+export const swaggerUiHandler = serverlessHttp(toServerlessApplication(app), {
+    basePath: '/docs',
+});
+
+export const skillsViewerHandler = serverlessHttp(toServerlessApplication(skillsViewerApp));
+
+export const statusListsHandler = serverlessHttp(toServerlessApplication(statusListsApp));
+
+// Passing the Fastify instance selects serverless-http's inject adapter, which
+// drops the API Gateway source address. The HTTP server path preserves it.
+const credentialRefreshProxy = serverlessHttp(toServerlessApplication(credentialRefreshApp.server));
+export const credentialRefreshHandler: typeof credentialRefreshProxy = async (event, context) => {
+    await credentialRefreshApp.ready();
+    return credentialRefreshProxy(event, context);
+};
+
+export const _openApiHandler = createOpenApiAwsLambdaHandler({
+    router: appRouter,
+    responseMeta: meta => {
+        return {
+            ...inboxBatchResponseMeta(meta),
+            headers: {
+                'Access-Control-Allow-Origin': '*',
+                'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
+                'Access-Control-Allow-Headers': 'Authorization, Content-Type',
+                ...publicShareLinkCacheControlHeaders(meta.paths),
+            },
+        };
+    },
+    createContext,
+    onError: handleTrpcError,
+});
+
+export const _trpcHandler = withInboxBatchBodyLimit(
+    awsLambdaRequestHandler({
+        allowMethodOverride: true,
+        router: appRouter,
+        createContext,
+        onError: handleTrpcError,
+        responseMeta: ({ paths }) => {
+            return {
+                headers: {
+                    'Access-Control-Allow-Origin': '*',
+                    'Access-Control-Allow-Methods': '*',
+                    'Access-Control-Allow-Headers': 'authorization',
+                    ...publicShareLinkCacheControlHeaders(paths),
+                },
+            };
+        },
+    }),
+    'trpc'
+);
+
+export const openApiHandler = Sentry.AWSLambda.wrapHandler(
+    async (event: APIGatewayProxyEventV2, context: Context): Promise<APIGatewayProxyResultV2> => {
+        if (event.requestContext.http.method === 'OPTIONS') {
+            return {
+                statusCode: 204,
+                headers: {
+                    'Access-Control-Allow-Origin': '*',
+                    'Access-Control-Allow-Headers': 'Authorization, Content-Type',
+                    'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
+                },
+            };
+        }
+
+        return _openApiHandler(event, context);
+    }
+);
+
+export const trpcHandler = Sentry.AWSLambda.wrapHandler(
+    async (event: APIGatewayProxyEventV2, context: Context): Promise<APIGatewayProxyResultV2> => {
+        if (event.requestContext.http.method === 'OPTIONS') {
+            return {
+                statusCode: 200,
+                headers: {
+                    'Access-Control-Allow-Origin': '*',
+                    'Access-Control-Allow-Headers': '*',
+                    'Access-Control-Allow-Methods': '*',
+                },
+            };
+        }
+
+        return _trpcHandler(event, context);
+    }
+);
+
+export const inboxQueueWorker: SQSHandler = Sentry.AWSLambda.wrapHandler(async event => {
+    const { processInboxQueueMessage } = await import('./src/helpers/inbox-queue.helpers');
+    const batchItemFailures = [];
+    for (const record of event.Records) {
+        try {
+            await processInboxQueueMessage(record.body);
+        } catch {
+            console.error('Inbox worker message failed', { messageId: record.messageId });
+            batchItemFailures.push({ itemIdentifier: record.messageId });
+        }
+    }
+    return { batchItemFailures } satisfies SQSBatchResponse;
+});
+
+export const inboxQueueDispatcher = Sentry.AWSLambda.wrapHandler(
+    async (_event: unknown, context: Context): Promise<void> => {
+        const { dispatchInboxJobs } = await import('./src/helpers/inbox-queue.helpers');
+        // Share one clock across publication and recovery, retaining five seconds for shutdown.
+        const deadline = Date.now() + Math.max(0, context.getRemainingTimeInMillis() - 5_000);
+        await dispatchInboxJobs(deadline);
+    }
+);
+
+export const inboxDeadLetterWorker: SQSHandler = Sentry.AWSLambda.wrapHandler(async event => {
+    const { processInboxDeadLetter } = await import('./src/helpers/inbox-queue.helpers');
+    const batchItemFailures = [];
+    for (const record of event.Records) {
+        try {
+            await processInboxDeadLetter(record.body);
+        } catch {
+            console.error('Inbox dead-letter processing failed', { messageId: record.messageId });
+            batchItemFailures.push({ itemIdentifier: record.messageId });
+        }
+    }
+    return { batchItemFailures } satisfies SQSBatchResponse;
+});
+
+export const notificationsWorker: SQSHandler = Sentry.AWSLambda.wrapHandler(async event => {
+    const batchItemFailures = await Promise.all(
+        event.Records.map(async record => {
+            try {
+                await deliverQueuedNotification(record.body);
+
+                return undefined;
+            } catch (error) {
+                console.error('Notification queue record failed', {
+                    messageId: record.messageId,
+                    error,
+                });
+
+                return { itemIdentifier: record.messageId };
+            }
+        })
+    );
+
+    return {
+        batchItemFailures: batchItemFailures.filter(
+            (failure): failure is { itemIdentifier: string } => failure !== undefined
+        ),
+    } satisfies SQSBatchResponse;
+});
+
+export const inboxMaintenanceHandler = Sentry.AWSLambda.wrapHandler(async (): Promise<void> => {
+    const counts = await runInboxMaintenance();
+    console.log('Universal Inbox maintenance completed', counts);
+});

package/package.json

@@ -1,11 +1,11 @@
 {
     "name": "@learncard/network-brain-service",
-    "version": "3.19.1",
+    "version": "4.0.1",
     "description": "",
     "engines": {
         "node": ">=24.12 <25"
     },
-    "packageManager": "bun@1.3.14",
+    "packageManager": "bun@1.4.2",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",
     "scripts": {
@@ -59,25 +59,26 @@
     },
     "dependencies": {
         "@aws-sdk/client-sqs": "^3.379.1",
-        "@digitalcredentials/issuer-registry-client": "^3.2.0-beta.5",
+        "@digitalcredentials/issuer-registry-client": "^4.1.0",
         "@fastify/cors": "^11.2.0",
         "@google/genai": "^1.27.0",
-        "@learncard/credential-library": "2.0.5",
-        "@learncard/core": "9.4.37",
-        "@learncard/crypto-plugin": "1.1.37",
-        "@learncard/did-web-plugin": "1.1.37",
-        "@learncard/didkey-plugin": "1.1.37",
-        "@learncard/didkit-plugin": "1.10.2",
-        "@learncard/didkit-plugin-node": "0.3.2",
-        "@learncard/dynamic-loader-plugin": "1.1.37",
-        "@learncard/encryption-plugin": "1.1.37",
-        "@learncard/expiration-plugin": "1.2.37",
-        "@learncard/email-templates": "1.2.0",
-        "@learncard/helpers": "1.6.1",
-        "@learncard/learn-card-plugin": "1.2.37",
-        "@learncard/types": "5.22.0",
-        "@learncard/vc-plugin": "1.6.3",
-        "@learncard/vc-templates-plugin": "1.1.37",
+        "@learncard/credential-library": "2.1.1",
+        "@learncard/core": "9.4.38",
+        "@learncard/crypto-plugin": "1.1.38",
+        "@learncard/did-web-plugin": "1.1.38",
+        "@learncard/didkey-plugin": "1.1.38",
+        "@learncard/didkit-plugin": "1.10.3",
+        "@learncard/didkit-plugin-node": "0.3.3",
+        "@learncard/dynamic-loader-plugin": "1.1.38",
+        "@learncard/encryption-plugin": "1.1.38",
+        "@learncard/expiration-plugin": "1.2.38",
+        "@learncard/email-templates": "1.2.1",
+        "@learncard/helpers": "1.6.2",
+        "@learncard/learn-card-plugin": "1.2.38",
+        "@learncard/partner-connect-core": "0.2.0",
+        "@learncard/types": "5.23.0",
+        "@learncard/vc-plugin": "1.6.4",
+        "@learncard/vc-templates-plugin": "1.1.38",
         "@sentry/serverless": "7.61.0",
         "@trpc/server": "11.8.0",
         "@types/lodash": "^4.14.191",

package/project.json

@@ -35,7 +35,14 @@
         },
         "build": {
             "executor": "nx:run-script",
-            "inputs": ["source"],
+            "inputs": [
+                "source",
+                "{projectRoot}/bundle.mjs",
+                "{projectRoot}/esbuildPlugins.cjs",
+                "{projectRoot}/package.json",
+                "{projectRoot}/tsconfig*.json",
+                "{workspaceRoot}/packages/service-config/src/**/*"
+            ],
             "options": {
                 "script": "build"
             }

package/scripts/export-openapi.ts

@@ -0,0 +1,20 @@
+import { resolve } from 'node:path';
+import { configureOfflineSchemaEnvironment } from './offline-schema-environment';
+
+const output = process.argv[2];
+if (!output)
+    throw new Error('Usage: bun --conditions=development scripts/export-openapi.ts OUTPUT');
+
+// Schema export registers routes, but never calls them or loads local credentials.
+configureOfflineSchemaEnvironment();
+
+// Static imports would initialize the router before service credentials are removed.
+const { openApiDocument } = await import('../src/openapi');
+
+await Bun.write(
+    resolve(output),
+    `${JSON.stringify(openApiDocument, null, 2)}
+`
+);
+console.log(`Exported ${Object.keys(openApiDocument.paths ?? {}).length} local OpenAPI paths`);
+process.exit(0);

package/scripts/offline-schema-environment.ts

@@ -0,0 +1,18 @@
+// These tools only import validators/routes; they must never inherit service credentials.
+export function configureOfflineSchemaEnvironment(): void {
+    for (const name of Object.keys(process.env)) {
+        if (!['PATH', 'HOME', 'TMPDIR'].includes(name)) delete process.env[name];
+    }
+    Object.assign(process.env, {
+        NODE_ENV: 'test',
+        DOTENV_CONFIG_PATH: '/dev/null',
+        SEED: 'a'.repeat(64),
+        NEO4J_URI: 'bolt://127.0.0.1:1',
+        NEO4J_USERNAME: 'schema-export',
+        NEO4J_PASSWORD: 'synthetic-schema-export',
+        NEO4J_SKIP_INDICES: 'true',
+        SKIP_DIDKIT_NAPI: 'true',
+        SKIP_SKILL_FRAMEWORK_SEED: 'true',
+        TRACE_CONSOLE: 'false',
+    });
+}

package/scripts/verify-python-contracts.ts

@@ -0,0 +1,72 @@
+import assert from 'node:assert/strict';
+import type { ZodType } from 'zod';
+
+import { configureOfflineSchemaEnvironment } from './offline-schema-environment';
+
+type CapturedRequest = {
+    method: string;
+    path: string;
+    body: unknown;
+    serverValid: boolean;
+};
+
+const capture = process.argv[2];
+if (!capture)
+    throw new Error(
+        'Usage: bun --conditions=development scripts/verify-python-contracts.ts CAPTURE'
+    );
+configureOfflineSchemaEnvironment();
+
+// Static imports would initialize router dependencies before credentials are removed.
+const { AllocateCredentialRefreshInputValidator, PublishCredentialRefreshInputValidator } =
+    await import('@learncard/types');
+const { activityRouter } = await import('../src/routes/activity');
+
+const activityInputs: Record<string, ZodType> = {
+    '/activity/credentials': activityRouter._def.procedures.getMyActivities._def.inputs.at(
+        -1
+    ) as ZodType,
+    '/activity/credentials/stats': activityRouter._def.procedures.getActivityStats._def.inputs.at(
+        -1
+    ) as ZodType,
+};
+const records: CapturedRequest[] = await Bun.file(capture).json();
+for (const record of records) {
+    const url = new URL(record.path, 'http://offline.invalid');
+    let valid: boolean;
+    if (url.pathname === '/credential-refresh/publish') {
+        valid = PublishCredentialRefreshInputValidator.safeParse(record.body).success;
+    } else if (url.pathname === '/credential-refresh/allocate') {
+        valid = AllocateCredentialRefreshInputValidator.safeParse(record.body).success;
+    } else {
+        const validator = activityInputs[url.pathname];
+        assert(validator, `No source validator for captured path ${url.pathname}`);
+        valid = validator.safeParse(Object.fromEntries(url.searchParams)).success;
+    }
+    assert.equal(
+        valid,
+        record.serverValid,
+        `Source contract rejected/accepted unexpected input: ${record.method} ${record.path}`
+    );
+}
+
+// The historical client format and offset suffixes must remain invalid server input.
+for (const validator of Object.values(activityInputs)) {
+    for (const date of [
+        '2026-01-02T03:04:05.000000+0000',
+        '2026-01-02T03:04:05+00:00',
+        '2026-01-02T03:04:05',
+    ]) {
+        for (const field of ['startDate', 'endDate']) {
+            assert.equal(
+                validator.safeParse({ [field]: date }).success,
+                false,
+                `Server unexpectedly accepts ${field}=${date}`
+            );
+        }
+    }
+}
+console.log(
+    `Verified ${records.length} captured publication/allocation/activity cases and Z-only boundaries against actual source validators`
+);
+process.exit(0);

package/serverless-local.yml

@@ -50,7 +50,9 @@ provider:
         INBOX_QUEUE_URL: ${env:INBOX_QUEUE_URL, ''}
         INBOX_QUEUE_ENDPOINT: ${env:INBOX_QUEUE_ENDPOINT, ''}
         PORT: ${env:PORT, 3000}
-        LAMBDA_STAGE: ${opt:stage, "dev"}
+        CONFIG_STAGE: ${env:CONFIG_STAGE, ''}
+        # serverless-offline sets AWS_LAMBDA_FUNCTION_NAME, so bootstrap reads LAMBDA_STAGE.
+        LAMBDA_STAGE: ${env:CONFIG_STAGE, ''}
         SEED: ${env:SEED}
         NEO4J_URI: ${env:NEO4J_URI}
         NEO4J_USERNAME: ${env:NEO4J_USERNAME}
@@ -61,17 +63,12 @@ provider:
             'Fn::GetAtt': [ElasticCacheCluster, RedisEndpoint.Port]
         NOTIFICATIONS_QUEUE_URL: ${construct:notifications-queue.queueUrl}
         SKILL_EMBEDDING_GOOGLE_API_KEY: ${env:SKILL_EMBEDDING_GOOGLE_API_KEY, ""}
-        SKILL_EMBEDDING_GOOGLE_MODEL: ${env:SKILL_EMBEDDING_GOOGLE_MODEL, "gemini-embedding-001"}
         SKILL_EMBEDDING_BATCH_SIZE: ${env:SKILL_EMBEDDING_BATCH_SIZE, "25"}
         SKILL_EMBEDDING_BACKFILL_ON_STARTUP: ${env:SKILL_EMBEDDING_BACKFILL_ON_STARTUP, "false"}
         SKILL_EMBEDDING_BACKFILL_LOCK_TTL_SECONDS: ${env:SKILL_EMBEDDING_BACKFILL_LOCK_TTL_SECONDS, "900"}
         SKILL_EMBEDDING_BACKFILL_PAGE_SIZE: ${env:SKILL_EMBEDDING_BACKFILL_PAGE_SIZE, "100"}
         SKILL_EMBEDDING_BACKFILL_BATCH_SIZE: ${env:SKILL_EMBEDDING_BACKFILL_BATCH_SIZE, "50"}
-        OIDC_TRUSTED_ISSUERS: ${env:OIDC_TRUSTED_ISSUERS, ""}
-        OIDC_EXPECTED_AUDIENCE: ${env:OIDC_EXPECTED_AUDIENCE, ""}
-        CREDENTIAL_REFRESH_ENABLED: ${env:CREDENTIAL_REFRESH_ENABLED, "false"}
         CREDENTIAL_REFRESH_DIGEST_SECRET: ${env:CREDENTIAL_REFRESH_DIGEST_SECRET, ""}
-        CREDENTIAL_REFRESH_NOTIFICATION_WINDOW_HOURS: ${env:CREDENTIAL_REFRESH_NOTIFICATION_WINDOW_HOURS, "24"}
     tracing:
         apiGateway: true
         lambda: true