@learncard/network-brain-service 3.19.1 → 4.0.1

package/src/helpers/share-link-policy/resolver.ts

@@ -9,23 +9,31 @@ import type {
 /**
  * Pure policy decision table.
  *
- * - known minor, managed or unknown age => no views, 30 days
+ * - personal known minor, managed or unknown age => no views, 30 days
  * - known unmanaged adult => views enabled, 365 days
- *
+ * - service profile => views enabled without changing the age-derived expiry
  */
 export const composeShareLinkPolicy = (
     age: ShareLinkOwnerAge,
-    isManaged: boolean
+    isManaged: boolean,
+    isServiceProfile = false
 ): ShareLinkPolicySnapshot => {
-    const isMinor = age === 'minor' ? true : age === 'adult' ? false : null;
-    const policyResolved = age !== 'unknown';
+    // Service age exemption does not establish that the owner is an adult.
+    const isMinor = isServiceProfile
+        ? false
+        : age === 'minor'
+          ? true
+          : age === 'adult'
+            ? false
+            : null;
+    const policyResolved = isServiceProfile || age !== 'unknown';
     const isUnmanagedAdult = age === 'adult' && !isManaged;
 
     return {
         isMinor,
         policyResolved,
         defaultExpiryDays: isUnmanagedAdult ? 365 : 30,
-        viewCountingEnabled: isUnmanagedAdult,
+        viewCountingEnabled: isServiceProfile || isUnmanagedAdult,
     };
 };
 
@@ -38,12 +46,9 @@ export const createShareLinkPolicyResolver = (
 ): ShareLinkPolicyResolver => ({
     resolve: async (profileId: string): Promise<ShareLinkPolicySnapshot> => {
         try {
-            const [age, isManaged] = await Promise.all([
-                source.resolveOwnerAge(profileId),
-                source.isManaged(profileId),
-            ]);
+            const { age, isManaged, isServiceProfile } = await source.resolveOwner(profileId);
 
-            return composeShareLinkPolicy(age, isManaged);
+            return composeShareLinkPolicy(age, isManaged, isServiceProfile);
         } catch {
             return DEFAULT_SHARE_LINK_POLICY;
         }

package/src/helpers/share-link-policy/types.ts

@@ -12,26 +12,34 @@ export type ShareLinkOwnerAge = 'adult' | 'minor' | 'unknown';
 
 /** Immutable policy snapshot persisted with the share under the write lock. */
 export type ShareLinkPolicySnapshot = {
-    /** `true` known minor, `false` known adult, `null` unknown. */
+    /** `true` known minor, `false` known adult/service profile, `null` unknown. */
     isMinor: boolean | null;
-    /** `true` only when the age source returned a known adult/minor value. */
+    /** `true` when age is known or a persisted service profile is age-exempt. */
     policyResolved: boolean;
     defaultExpiryDays: 30 | 365;
     viewCountingEnabled: boolean;
 };
 
+/** Fresh graph-local classification; never persisted or inferred from an old snapshot. */
+export type CurrentShareLinkPolicy = ShareLinkPolicySnapshot & {
+    isServiceProfile: boolean;
+};
+
 /**
  * Authoritative server-side sources. Implementations must read persisted server
  * state only; no request-derived value may be used as authority.
  */
 export type ShareLinkPolicySource = {
     /**
-     * Resolve the owner's age. `unknown` is required when no trustworthy source
-     * exists; it must never be inferred from the absence of a manager.
+     * Read age, service classification and management from persisted state.
+     * Service profiles may bypass tracking age checks; explicitly typed children
+     * must never be classified as service profiles here.
      */
-    resolveOwnerAge: (profileId: string) => Promise<ShareLinkOwnerAge>;
-    /** Whether the profile is currently managed by another profile. */
-    isManaged: (profileId: string) => Promise<boolean>;
+    resolveOwner: (profileId: string) => Promise<{
+        age: ShareLinkOwnerAge;
+        isManaged: boolean;
+        isServiceProfile: boolean;
+    }>;
 };
 
 /** Injectable server-side policy resolver used by the coordinator. */

package/src/helpers/signingAuthority.helpers.ts

@@ -1,6 +1,10 @@
 import { environment } from '@environment';
 import { Agent, fetch as undiciFetch, type Response as UndiciResponse } from 'undici';
-import { getDidWebLearnCard, getLearnCard } from '@helpers/learnCard.helpers';
+import {
+    createDagJweForRecipients,
+    getDidWebLearnCard,
+    getLearnCard,
+} from '@helpers/learnCard.helpers';
 import { getDidWeb } from '@helpers/did.helpers';
 import { VCValidator, JWEValidator } from '@learncard/types';
 import type { UnsignedVC, VC, JWE } from '@learncard/types';
@@ -113,9 +117,17 @@ const getSaAgent = (): Agent => {
     return _saAgent;
 };
 
-const _mockIssueCredentialWithSigningAuthority = async (credential: UnsignedVC): Promise<VC> => {
+const _mockIssueCredentialWithSigningAuthority = async (
+    credential: UnsignedVC,
+    recipients?: string[]
+): Promise<VC | JWE> => {
     const learnCard = await getLearnCard();
-    return learnCard.invoke.issueCredential({ ...credential, issuer: learnCard.id.did() });
+    const signedCredential = await learnCard.invoke.issueCredential({
+        ...credential,
+        issuer: learnCard.id.did(),
+    });
+
+    return recipients ? createDagJweForRecipients(signedCredential, recipients) : signedCredential;
 };
 
 export async function issueCredentialWithSigningAuthority(
@@ -151,6 +163,10 @@ export async function issueCredentialWithSigningAuthority(
             retryable: false,
         });
     }
+    // The validation above excludes undefined subject IDs on the encrypted path.
+    const encryptionRecipients = encrypt
+        ? [...new Set([...(subjectIds as string[]), ownerDid, ...additionalEncryptionRecipients])]
+        : undefined;
     const credentialToIssue = appendCredentialStatus
         ? await appendBitstringStatusListEntries(credential, ownerProfile.profileId, domain)
         : credential;
@@ -177,7 +193,8 @@ export async function issueCredentialWithSigningAuthority(
             try {
                 if (IS_TEST_ENVIRONMENT) {
                     return await _mockIssueCredentialWithSigningAuthority(
-                        JSON.parse(serializedCredential)
+                        JSON.parse(serializedCredential),
+                        encryptionRecipients
                     );
                 }
 
@@ -189,16 +206,8 @@ export async function issueCredentialWithSigningAuthority(
                 perf.mark('initDid');
 
                 // Brain authenticates the request but must not be able to decrypt the response.
-                const encryption = encrypt
-                    ? {
-                          recipients: [
-                              ...new Set([
-                                  ...subjectIds,
-                                  ownerDid,
-                                  ...additionalEncryptionRecipients,
-                              ]),
-                          ],
-                      }
+                const encryption = encryptionRecipients
+                    ? { recipients: encryptionRecipients }
                     : undefined;
 
                 const didJwt = await traceCrypto('getDidAuthVp', () =>

package/src/helpers/smartResume.helpers.ts

@@ -0,0 +1,123 @@
+import { environment } from '@environment';
+import { ConsentFlowTermsValidator, type ConsentFlowTerms } from '@learncard/types';
+import { resolveUri } from '@helpers/uri.helpers';
+
+/** Publish only the terms returned by the locked consent/publication claim. */
+export const uploadSmartResume = async (
+    terms: ConsentFlowTerms,
+    did: string,
+    recipientToken: string
+): Promise<string | undefined> => {
+    const isProduction = !environment.IS_OFFLINE;
+
+    const srUrl = isProduction ? 'https://my.smartresume.com/' : 'https://mystage.smartresume.com/';
+    const clientId = environment.SMART_RESUME_CLIENT_ID;
+    const accessKey = environment.SMART_RESUME_ACCESS_KEY;
+
+    const accessTokenResponse = (await fetch(`${srUrl}api/v1/token`, {
+        method: 'POST',
+        signal: AbortSignal.timeout(30_000),
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Authorization: `Basic ${btoa(`${clientId}:${accessKey}`)}`,
+        },
+        body: new URLSearchParams({
+            grant_type: 'client_credentials',
+            scope: 'delete readonly replace',
+        }),
+    }).then(res => {
+        if (!res.ok) throw new Error(`SmartResume token request failed (${res.status})`);
+        return res.json();
+    })) as { access_token?: string };
+
+    const accessToken = accessTokenResponse.access_token;
+    if (!accessToken) throw new Error('Missing access_token for SmartResume');
+
+    const parsedTerms = ConsentFlowTermsValidator.parse(terms);
+
+    const categories = parsedTerms.read.credentials.categories;
+    const categoryValues = Object.values(categories) as Array<{ shared?: string[] }>;
+
+    const allSharedCredentialUris = [
+        // filter out duplicates
+        ...new Set(categoryValues.flatMap(({ shared }) => shared ?? [])),
+    ];
+
+    const resolvedCredentials = await Promise.all(
+        allSharedCredentialUris.map(async uri => {
+            let timer: ReturnType<typeof setTimeout> | undefined;
+            try {
+                return await Promise.race([
+                    resolveUri(uri),
+                    new Promise<never>((_, reject) => {
+                        timer = setTimeout(
+                            () => reject(new Error('Credential resolution timed out')),
+                            30_000
+                        );
+                    }),
+                ]);
+            } finally {
+                clearTimeout(timer);
+            }
+        })
+    );
+
+    type ResolvedCredential = {
+        issuer?: string | { id: string };
+        id?: string;
+        boostCredential?: Record<string, unknown>;
+    } & Record<string, unknown>;
+
+    const credentials = resolvedCredentials
+        .filter((cred): cred is ResolvedCredential => typeof cred === 'object' && cred !== null)
+        .map(cred =>
+            cred.boostCredential && typeof cred.boostCredential === 'object'
+                ? ({ ...cred.boostCredential, id: cred.id } as ResolvedCredential) // unwrap credential, preserve id
+                : cred
+        );
+
+    const transformedCredentials = credentials.map(cred => {
+        const issuer =
+            typeof cred.issuer === 'string' ? { id: cred.issuer } : cred.issuer || { id: '' };
+
+        return {
+            ...cred,
+            issuer,
+        };
+    });
+
+    const { name, email } = parsedTerms.read.personal;
+
+    const body = JSON.stringify({
+        '@context': [
+            'https://www.w3.org/ns/credentials/v2',
+            'https://purl.imsglobal.org/spec/ob/v3p0/context-3.0.3.json',
+            'https://w3id.org/security/suites/ed25519-2020/v1',
+        ],
+        recipienttoken: recipientToken,
+        recipient: {
+            id: did,
+            givenName: name && name !== 'Anonymous' ? name : '',
+            familyName: '', // this is necessary in order for givenName to be respected
+            email: email && email !== 'anonymous@hidden.com' ? email : '',
+        },
+        credentials: transformedCredentials,
+    });
+
+    const response = await fetch(`${srUrl}api/v1/credentials`, {
+        method: 'POST',
+        signal: AbortSignal.timeout(30_000),
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            'Content-Type': 'application/json',
+        },
+        body,
+    });
+
+    if (!response.ok) {
+        throw new Error(`SmartResume upload failed (${response.status})`);
+    }
+
+    const result = (await response.json()) as { redirect_url?: string };
+    return result.redirect_url;
+};

package/src/models/AppManifestVersion.ts

@@ -0,0 +1,43 @@
+import { ModelFactory, ModelRelatedNodesI, NeogmaInstance } from 'neogma';
+
+import { neogma } from '@instance';
+
+import { FlatAppManifestVersionType } from 'types/app-manifest';
+import { Integration, IntegrationInstance } from './Integration';
+import { AppStoreListing, AppStoreListingInstance } from './AppStoreListing';
+
+export type AppManifestVersionRelationships = {
+    integration: ModelRelatedNodesI<typeof Integration, IntegrationInstance>;
+    listing: ModelRelatedNodesI<typeof AppStoreListing, AppStoreListingInstance>;
+};
+
+export type AppManifestVersionInstance = NeogmaInstance<
+    FlatAppManifestVersionType,
+    AppManifestVersionRelationships
+>;
+
+export const AppManifestVersion = ModelFactory<
+    FlatAppManifestVersionType,
+    AppManifestVersionRelationships
+>(
+    {
+        label: 'AppManifestVersion',
+        schema: {
+            id: { type: 'string', required: true, uniqueItems: true },
+            version: { type: 'number', required: true },
+            manifestHash: { type: 'string', required: true },
+            manifestJson: { type: 'string', required: true },
+            status: { type: 'string', enum: ['draft', 'active', 'superseded'], required: true },
+            createdAt: { type: 'string', required: true },
+            activatedAt: { type: 'string', required: false },
+        },
+        relationships: {
+            integration: { model: Integration, direction: 'in', name: 'HAS_MANIFEST_VERSION' },
+            listing: { model: AppStoreListing, direction: 'in', name: 'USES_MANIFEST_VERSION' },
+        },
+        primaryKeyField: 'id',
+    },
+    neogma
+);
+
+export default AppManifestVersion;

package/src/models/AppStoreListing.ts

@@ -6,13 +6,16 @@ import { Integration, IntegrationInstance } from './Integration';
 import { Profile, ProfileInstance } from './Profile';
 import { Boost, BoostInstance } from './Boost';
 import { Credential, CredentialInstance } from './Credential';
+import { ConsentFlowContract, ConsentFlowInstance } from './ConsentFlowContract';
 import { SigningAuthority, SigningAuthorityInstance } from './SigningAuthority';
+import type { AppManifestVersion, AppManifestVersionInstance } from './AppManifestVersion';
 import {
     FlatAppStoreListingType,
     AppListingStatus,
     LaunchType,
     PromotionLevel,
     AgeRating,
+    PendingListingUpdateStatus,
 } from 'types/app-store-listing';
 
 export type AppStoreListingRelationships = {
@@ -73,6 +76,13 @@ export type AppStoreListingRelationships = {
         { name: string; did: string; isPrimary?: boolean },
         { name: string; did: string; isPrimary?: boolean }
     >;
+    hasConsentContract: ModelRelatedNodesI<
+        typeof ConsentFlowContract,
+        ConsentFlowInstance,
+        { scopeHash: string; createdAt: string },
+        { scopeHash: string; createdAt: string }
+    >;
+    usesManifestVersion: ModelRelatedNodesI<typeof AppManifestVersion, AppManifestVersionInstance>;
 };
 
 export type AppStoreListingInstance = NeogmaInstance<
@@ -114,6 +124,13 @@ export const AppStoreListing = ModelFactory<FlatAppStoreListingType, AppStoreLis
             min_age: { type: 'number', required: false },
             age_rating: { type: 'string', enum: AgeRating.options, required: false },
             contact_email: { type: 'string', required: false },
+            pending_update_json: { type: 'string', required: false },
+            pending_update_status: {
+                type: 'string',
+                enum: PendingListingUpdateStatus.options,
+                required: false,
+            },
+            pending_update_submitted_at: { type: 'string', required: false },
         } as any,
         relationships: {
             publishedBy: { model: Integration, direction: 'in', name: 'PUBLISHES_LISTING' },
@@ -204,6 +221,21 @@ export const AppStoreListing = ModelFactory<FlatAppStoreListingType, AppStoreLis
                     },
                 },
             },
+            hasConsentContract: {
+                model: ConsentFlowContract,
+                direction: 'out',
+                name: 'HAS_CONSENT_CONTRACT',
+                properties: {
+                    scopeHash: {
+                        property: 'scopeHash',
+                        schema: { type: 'string', required: true },
+                    },
+                    createdAt: {
+                        property: 'createdAt',
+                        schema: { type: 'string', required: true },
+                    },
+                },
+            },
         },
         primaryKeyField: 'listing_id',
     },

package/src/models/ConsentFlowContract.ts

@@ -14,16 +14,27 @@ export type ConsentFlowRelationships = {
         { signingAuthorityEndpoint: string; signingAuthorityName: string; issuer?: string }
     >;
     canWrite: ModelRelatedNodesI<typeof Profile, ProfileInstance>;
+    sharesDataWith: ModelRelatedNodesI<typeof Profile, ProfileInstance>;
     relatedTo: ModelRelatedNodesI<typeof Boost, BoostInstance>;
     requestedFor: ModelRelatedNodesI<
         typeof Profile,
         ProfileInstance,
         {
-            status: 'pending' | 'accepted' | 'denied';
+            status: 'pending' | 'accepted' | 'denied' | 'cancelled';
+            requestId?: string;
+            requestedBy?: string;
+            externalReferenceId?: string;
+            message?: string;
+            requestedAt?: string;
             readStatus?: 'unseen' | 'seen' | null;
         },
         {
-            status: 'pending' | 'accepted' | 'denied';
+            status: 'pending' | 'accepted' | 'denied' | 'cancelled';
+            requestId?: string;
+            requestedBy?: string;
+            externalReferenceId?: string;
+            message?: string;
+            requestedAt?: string;
             readStatus?: 'unseen' | 'seen' | null;
         }
     >;
@@ -47,6 +58,8 @@ export const ConsentFlowContract = ModelFactory<FlatDbContractType, ConsentFlowR
             createdAt: { type: 'string', required: true },
             updatedAt: { type: 'string', required: true },
             expiresAt: { type: 'string', required: false },
+            audienceVersion: { type: 'number', required: false },
+            hasConsented: { type: 'boolean', required: false },
         } as any,
         relationships: {
             createdBy: { model: Profile, direction: 'out', name: 'CREATED_BY' },
@@ -70,17 +83,35 @@ export const ConsentFlowContract = ModelFactory<FlatDbContractType, ConsentFlowR
                 },
             },
             canWrite: { model: Profile, direction: 'out', name: 'CAN_WRITE' },
+            sharesDataWith: { model: Profile, direction: 'out', name: 'SHARES_DATA_WITH' },
             relatedTo: { model: Boost, direction: 'out', name: 'RELATED_TO' },
             requestedFor: {
                 model: Profile,
                 direction: 'out',
                 name: 'REQUESTED_FOR',
                 properties: {
+                    requestId: {
+                        property: 'requestId',
+                        schema: { type: 'string', required: false },
+                    },
+                    requestedBy: {
+                        property: 'requestedBy',
+                        schema: { type: 'string', required: false },
+                    },
+                    externalReferenceId: {
+                        property: 'externalReferenceId',
+                        schema: { type: 'string', required: false },
+                    },
+                    message: { property: 'message', schema: { type: 'string', required: false } },
+                    requestedAt: {
+                        property: 'requestedAt',
+                        schema: { type: 'string', required: false },
+                    },
                     status: {
                         property: 'status',
                         schema: {
                             type: 'string',
-                            enum: ['pending', 'accepted', 'denied'],
+                            enum: ['pending', 'accepted', 'denied', 'cancelled'],
                             required: false,
                         },
                     },

package/src/models/ConsentFlowTerms.ts

@@ -19,10 +19,20 @@ export const ConsentFlowTerms = ModelFactory<FlatDbTermsType, ConsentFlowTermsRe
     {
         label: 'ConsentFlowTerms',
         schema: {
+            smartResumeFingerprint: { type: 'string', required: false },
+            smartResumePublicationStatus: { type: 'string', required: false },
+            smartResumeLeaseId: { type: 'string', required: false },
+            smartResumeLeaseUntil: { type: 'number', required: false },
+            smartResumeMutationVersion: { type: 'number', required: false },
+            smartResumeRedirectUrl: { type: 'string', required: false },
             id: { type: 'string', required: true },
+            'referral.requestId': { type: 'string', required: false },
+            'referral.requestedBy': { type: 'string', required: false },
+            'referral.externalReferenceId': { type: 'string', required: false },
             status: { type: 'string', required: true },
             createdAt: { type: 'string', required: false },
             updatedAt: { type: 'string', required: false },
+            mutationVersion: { type: 'number', required: false },
             expiresAt: { type: 'string', required: false },
             oneTime: { type: 'boolean', required: false },
             deniedWriters: { type: 'string[]', required: false },

package/src/models/ConsentFlowTransaction.ts

@@ -21,6 +21,9 @@ export const ConsentFlowTransaction = ModelFactory<
         label: 'ConsentFlowTransaction',
         schema: {
             id: { type: 'string', required: true },
+            'referral.requestId': { type: 'string', required: false },
+            'referral.requestedBy': { type: 'string', required: false },
+            'referral.externalReferenceId': { type: 'string', required: false },
             status: { type: 'string', required: true },
             expiresAt: { type: 'string', required: false },
             oneTime: { type: 'boolean', required: false },

package/src/models/Integration.ts

@@ -3,11 +3,13 @@ import { ModelFactory, ModelRelatedNodesI, NeogmaInstance } from 'neogma';
 import { neogma } from '@instance';
 
 import { Profile, ProfileInstance } from './Profile';
+import type { AppManifestVersion, AppManifestVersionInstance } from './AppManifestVersion';
 import { FlatIntegrationType } from 'types/integration';
 
 export type IntegrationRelationships = {
     createdBy: ModelRelatedNodesI<typeof Profile, ProfileInstance>;
     publishesListing: ModelRelatedNodesI<any, any>;
+    hasManifestVersion: ModelRelatedNodesI<typeof AppManifestVersion, AppManifestVersionInstance>;
 };
 
 export type IntegrationInstance = NeogmaInstance<FlatIntegrationType, IntegrationRelationships>;

package/src/models/ShareLink.ts

@@ -33,6 +33,8 @@ export type ShareLinkRecord = {
     ownerProfileId: string;
     version: number;
     contentVersion: number;
+    attachmentId?: string | null;
+    attachmentChunkCount?: number | null;
     /**
      * Monotonic fence. Bumped on every reservation and on revoke; a worker may
      * only finalize the reservation whose generation still equals this value.
@@ -90,6 +92,8 @@ export const ShareLink = ModelFactory<ShareLinkProperties, Record<string, never>
             ownerProfileId: { type: 'string', required: true },
             version: { type: 'number', required: true },
             contentVersion: { type: 'number', required: true },
+            attachmentId: { type: 'string', required: false },
+            attachmentChunkCount: { type: 'number', required: false },
             generation: { type: 'number', required: true },
             status: { type: 'string', required: true, enum: ['pending', 'active', 'stopped'] },
             contentState: {

package/src/models/index.ts

@@ -1,5 +1,6 @@
 import { environment } from '@environment';
 import { neogma } from '@instance';
+import { contractEventMaintenanceSchema } from '@helpers/contract-event-maintenance.helpers';
 
 import { Boost } from './Boost';
 import { Profile } from './Profile';
@@ -11,6 +12,7 @@ import { Skill } from './Skill';
 import { Tag } from './Tag';
 import { AppStoreListing } from './AppStoreListing';
 import { Integration } from './Integration';
+import { AppManifestVersion } from './AppManifestVersion';
 import { CredentialActivity } from './CredentialActivity';
 import { CredentialRefresh } from './CredentialRefresh';
 import { StatusList } from './StatusList';
@@ -92,6 +94,19 @@ Integration.addRelationships({
         direction: 'out',
         name: 'PUBLISHES_LISTING',
     },
+    hasManifestVersion: {
+        model: AppManifestVersion,
+        direction: 'out',
+        name: 'HAS_MANIFEST_VERSION',
+    },
+});
+
+AppStoreListing.addRelationships({
+    usesManifestVersion: {
+        model: AppManifestVersion,
+        direction: 'out',
+        name: 'USES_MANIFEST_VERSION',
+    },
 });
 
 Profile.addRelationships({
@@ -128,6 +143,9 @@ const shouldCreateIndices =
     environment.NODE_ENV === 'production' || !environment.NEO4J_SKIP_INDICES;
 
 const indexQueries = [
+    'CREATE CONSTRAINT consent_event_id IF NOT EXISTS FOR (e:ConsentFlowEvent) REQUIRE e.id IS UNIQUE',
+    'CREATE CONSTRAINT consent_delivery_id IF NOT EXISTS FOR (d:ConsentFlowEventDelivery) REQUIRE d.id IS UNIQUE',
+    ...contractEventMaintenanceSchema,
     'CREATE INDEX profileId_idx IF NOT EXISTS FOR (p:Profile) ON (p.profileId)',
     'CREATE INDEX profile_did_idx IF NOT EXISTS FOR (p:Profile) ON (p.did)',
     'CREATE TEXT INDEX profileId_text_idx IF NOT EXISTS FOR (n:Profile) ON (n.profileId)',
@@ -152,6 +170,10 @@ const indexQueries = [
     'CREATE INDEX claim_hook_updated_idx IF NOT EXISTS FOR (c:ClaimHook) ON (c.updatedAt)',
     'CREATE INDEX integration_id_idx IF NOT EXISTS FOR (i:Integration) ON (i.id)',
     'CREATE INDEX integration_publishablekey_idx IF NOT EXISTS FOR (i:Integration) ON (i.publishableKey)',
+    'CREATE INDEX app_manifest_version_id_idx IF NOT EXISTS FOR (m:AppManifestVersion) ON (m.id)',
+    'CREATE INDEX app_manifest_version_version_idx IF NOT EXISTS FOR (m:AppManifestVersion) ON (m.version)',
+    'CREATE INDEX app_manifest_version_hash_idx IF NOT EXISTS FOR (m:AppManifestVersion) ON (m.manifestHash)',
+    'CREATE INDEX app_manifest_version_status_idx IF NOT EXISTS FOR (m:AppManifestVersion) ON (m.status)',
     'CREATE INDEX skill_framework_id_idx IF NOT EXISTS FOR (f:SkillFramework) ON (f.id)',
     'CREATE TEXT INDEX skill_framework_name_text_idx IF NOT EXISTS FOR (f:SkillFramework) ON (f.name)',
     'CREATE INDEX skill_id_idx IF NOT EXISTS FOR (s:Skill) ON (s.id)',
@@ -254,6 +276,7 @@ export * from './SkillFramework';
 export * from './Skill';
 export * from './Tag';
 export * from './Integration';
+export * from './AppManifestVersion';
 export * from './AppStoreListing';
 export * from './CredentialActivity';
 export * from './CredentialRefresh';

package/src/models/share-link-constraints.ts

@@ -9,6 +9,9 @@ import { neogma } from '@instance';
  * makes the resulting race fail closed instead of forking state.
  */
 const SHARE_LINK_CONSTRAINT_QUERIES = [
+    'CREATE CONSTRAINT share_link_attachment_stage_key_unique IF NOT EXISTS FOR (a:ShareLinkAttachmentStage) REQUIRE (a.key) IS UNIQUE',
+    'CREATE CONSTRAINT share_link_attachment_id_unique IF NOT EXISTS FOR (a:ShareLinkAttachmentStage) REQUIRE (a.attachmentId) IS UNIQUE',
+    'CREATE CONSTRAINT share_attachment_owner_quota_key_unique IF NOT EXISTS FOR (q:ShareAttachmentOwnerQuota) REQUIRE (q.key) IS UNIQUE',
     // A share id is globally unique across namespaces.
     'CREATE CONSTRAINT share_link_id_unique IF NOT EXISTS FOR (s:ShareLink) REQUIRE (s.id) IS UNIQUE',
     // One idempotency record per (namespace, owner, operation kind, client request).
@@ -26,6 +29,8 @@ const SHARE_LINK_CONSTRAINT_QUERIES = [
  * idempotent and shares the same readiness gate as the constraints.
  */
 const SHARE_LINK_INDEX_QUERIES = [
+    'CREATE INDEX share_attachment_stage_owner_idx IF NOT EXISTS FOR (a:ShareLinkAttachmentStage) ON (a.namespace, a.ownerProfileId, a.status)',
+    'CREATE INDEX share_attachment_stage_expiry_idx IF NOT EXISTS FOR (a:ShareLinkAttachmentStage) ON (a.namespace, a.status, a.expiresAt)',
     'CREATE INDEX share_link_ns_owner_idx IF NOT EXISTS FOR (s:ShareLink) ON (s.namespace, s.ownerProfileId)',
     // Bounded owner-list keyset pagination: filters on the leading
     // (namespace, ownerProfileId) prefix and orders by the immutable