@learncard/network-brain-service 4.0.2 → 4.0.4

package/src/accesslayer/profile/read.ts

@@ -3,6 +3,7 @@ import { Profile } from '@models';
 import { ProfileType, FlatProfileType } from 'types/profile';
 import { transformProfileId } from '@helpers/profile.helpers';
 import { inflateObject } from '@helpers/objects.helpers';
+import { PROFILE_DISPLAY_NAME_LOWER_FIELD, normalizeProfileSearchText } from './search-fields';
 
 export const getProfileByProfileId = async (profileId: string): Promise<ProfileType | null> => {
     const result = await new QueryBuilder()
@@ -86,6 +87,15 @@ export const checkIfProfileExists = async ({
     return false;
 };
 
+/**
+ * Case-insensitive substring search over `profileId` and `displayName`.
+ *
+ * Each branch of the `UNION` is a single `CONTAINS` predicate so the planner can seek a TEXT
+ * index for it (`profileId_text_idx` and `profile_displayname_lower_text_idx`) instead of
+ * scanning every `Profile`. `UNION` (not `UNION ALL`) dedupes a profile that matches both.
+ * The visibility/private/service/blacklist filters, ordering and limit are applied to the
+ * merged set, same as before.
+ */
 export const searchProfiles = async (
     searchInput: string,
     {
@@ -100,15 +110,25 @@ export const searchProfiles = async (
 ): Promise<ProfileType[]> => {
     const result = await new QueryBuilder(
         new BindParam({
+            // profileId is stored lowercased by transformProfileId
             input: searchInput.toLowerCase(),
-            inputRegex: `(?i).*${searchInput}.*`,
+            // normalized in Cypher below with the same expression displayNameLower is written with
+            displayNameInput: searchInput,
             blacklist,
         })
     )
-        .match({ identifier: 'profile', model: Profile })
+        .raw(
+            `CALL {
+    MATCH (profile:Profile) WHERE profile.profileId CONTAINS $input RETURN profile
+    UNION
+    MATCH (profile:Profile) WHERE profile.${PROFILE_DISPLAY_NAME_LOWER_FIELD} CONTAINS ${normalizeProfileSearchText(
+        '$displayNameInput'
+    )} RETURN profile
+}`
+        )
+        .with('profile')
         .where(
             `
-(profile.profileId CONTAINS $input OR profile.displayName =~ $inputRegex) AND 
 (
     profile.profileVisibility IS NULL OR
     profile.profileVisibility = "public"

package/src/accesslayer/profile/search-fields.ts

@@ -0,0 +1,69 @@
+/**
+ * Profile search runs `CONTAINS` against TEXT indexes, and TEXT index `CONTAINS` is case-sensitive.
+ * `profileId` is already stored lowercased (`transformProfileId`), so it can be searched as-is.
+ * `displayName` keeps the casing people typed, so we keep a normalized copy of it in
+ * `displayNameLower` (TEXT-indexed by `profile_displayname_lower_text_idx`) and search that.
+ *
+ * Every write that sets `displayName` must also set `displayNameLower`, and writes, the backfill
+ * and the search input all go through the same Cypher expression, `normalizeProfileSearchText`.
+ */
+export const PROFILE_DISPLAY_NAME_LOWER_FIELD = 'displayNameLower';
+
+/**
+ * The one search normalization for display names: Cypher `toLower`, then final sigma (ς, U+03C2)
+ * folded to σ (U+03C3).
+ *
+ * `toLower` alone isn't safe for substring matching because it's context-sensitive for Greek:
+ * a capital Σ becomes ς at the end of a word and σ everywhere else. So `ΑΝΑΣΤΑΣΙΑ` is stored as
+ * `αναστασια`, but the search input `ΑΝΑΣ` lowercases to `ανας` and no longer matches. Folding ς to
+ * σ afterwards makes the result the same for a letter wherever it sits in the string, so a
+ * substring of a name always normalizes to a substring of the normalized name.
+ *
+ * Use this for writes, the backfill and queries alike. Changing it means re-running the backfill.
+ */
+export const normalizeProfileSearchText = (expression: string): string =>
+    `replace(toLower(${expression}), '\u03C2', '\u03C3')`;
+
+/** Cypher fragment that keeps `displayNameLower` in sync with `displayName` for `identifier`. */
+export const syncProfileDisplayNameLower = (identifier: string): string =>
+    `${identifier}.${PROFILE_DISPLAY_NAME_LOWER_FIELD} = ${normalizeProfileSearchText(
+        `${identifier}.displayName`
+    )}`;
+
+/** Cypher predicate: true for a profile whose `displayNameLower` is missing or stale. */
+export const profileDisplayNameLowerIsStale = (identifier: string): string =>
+    `${identifier}.displayName IS NOT NULL
+  AND (${identifier}.${PROFILE_DISPLAY_NAME_LOWER_FIELD} IS NULL
+       OR ${identifier}.${PROFILE_DISPLAY_NAME_LOWER_FIELD} <> ${normalizeProfileSearchText(
+           `${identifier}.displayName`
+       )})`;
+
+/**
+ * One-pass, idempotent backfill for profiles written before `displayNameLower` existed (or whose
+ * copy has drifted). Uses `CALL { ... } IN TRANSACTIONS`, so it has to run in an auto-commit
+ * transaction (e.g. `session.run`), not inside an explicit transaction.
+ */
+export const buildBackfillProfileDisplayNameLowerQuery = (batchSize = 1000): string => `
+MATCH (profile:Profile)
+WHERE ${profileDisplayNameLowerIsStale('profile')}
+CALL {
+    WITH profile
+    SET ${syncProfileDisplayNameLower('profile')}
+} IN TRANSACTIONS OF ${Number.isFinite(batchSize) ? Math.max(1, Math.floor(batchSize)) : 1000} ROWS
+`;
+
+/** Anything that runs a query in an auto-commit transaction, e.g. `query => session.run(query)`. */
+export type AutoCommitRunner = (
+    query: string
+) => PromiseLike<{ summary: { counters: { updates: () => Record<string, number> } } }>;
+
+/** Runs the backfill and returns how many profiles were updated. */
+export const backfillProfileDisplayNameLower = async (
+    run: AutoCommitRunner,
+    { batchSize = 1000 }: { batchSize?: number } = {}
+): Promise<number> => {
+    // The batch size is inlined: OF ... ROWS needs an integer and JS numbers bind as floats.
+    const result = await run(buildBackfillProfileDisplayNameLowerQuery(batchSize));
+
+    return result.summary.counters.updates().propertiesSet ?? 0;
+};

package/src/accesslayer/profile/update.ts

@@ -2,6 +2,7 @@ import { QueryBuilder, BindParam } from 'neogma';
 import { flattenObject } from '@helpers/objects.helpers';
 import { Profile } from '@models';
 import { ProfileType } from 'types/profile';
+import { syncProfileDisplayNameLower } from './search-fields';
 
 export const updateProfile = async (profile: ProfileType, updates: Partial<ProfileType>) => {
     const currentDisplay = profile.display;
@@ -14,7 +15,12 @@ export const updateProfile = async (profile: ProfileType, updates: Partial<Profi
 
     const query = new QueryBuilder(new BindParam({ params: newUpdates }))
         .match({ model: Profile, where: { profileId: profile.profileId }, identifier: 'profile' })
-        .set('profile += $params');
+        .set(
+            // Keep the lowercased search copy in sync whenever displayName changes
+            'displayName' in newUpdates
+                ? `profile += $params, ${syncProfileDisplayNameLower('profile')}`
+                : 'profile += $params'
+        );
 
     const result = await query.run();
 

package/src/helpers/boost-storage.helpers.test.ts

@@ -65,7 +65,12 @@ vi.mock('@tracing', () => ({
     traceInternal: async (_name: string, action: () => unknown) => action(),
 }));
 
-import { issueClaimLinkBoost, sendBoost } from './boost.helpers';
+import {
+    issueClaimLinkBoost,
+    prepareCredentialFromBoost,
+    sendBoost,
+    stampIssuanceDate,
+} from './boost.helpers';
 
 const vc = {
     '@context': ['https://www.w3.org/2018/credentials/v1'],
@@ -223,6 +228,155 @@ describe('boost payload storage', () => {
         }
     );
 
+    describe('malformed template issuance dates', () => {
+        // Seen on a production Boost template; it is not RFC 3339, so DIDKit refuses to sign it.
+        const MALFORMED_DATE = '2025-10-19+053008:18:16';
+        // The reused JOTA-JOTI "Health and Well-being" Boost that carried it.
+        const BOOST_ID = 'e073d183-8304-419f-b4f6-ef91fda6524c';
+        const V1 = ['https://www.w3.org/2018/credentials/v1'];
+        const V2 = ['https://www.w3.org/ns/credentials/v2'];
+        const authority = { relationship: { did: 'did:example:sa' } } as Parameters<
+            typeof issueClaimLinkBoost
+        >[4];
+        const boostWith = (template: Record<string, unknown>) =>
+            ({
+                ...options.boost,
+                dataValues: {
+                    id: BOOST_ID,
+                    boost: JSON.stringify({ ...vc, boostId: undefined, ...template }),
+                },
+            }) as Parameters<typeof issueClaimLinkBoost>[0];
+        const expectFreshDate = (value: unknown, before: number) => {
+            expect(typeof value).toBe('string');
+            expect(value).toBe(new Date(value as string).toISOString());
+            expect(Date.parse(value as string)).toBeGreaterThanOrEqual(before);
+        };
+
+        beforeEach(() => {
+            mocks.signingAuthority.mockResolvedValue({
+                kind: 'issued-credential',
+                credential: jwe,
+                statusEntries: [],
+            });
+        });
+
+        it.each([
+            [
+                'VC 1.1 issuanceDate',
+                { '@context': V1, issuanceDate: MALFORMED_DATE },
+                'issuanceDate',
+            ],
+            [
+                'VC 2.0 validFrom',
+                { '@context': V2, issuanceDate: undefined, validFrom: MALFORMED_DATE },
+                'validFrom',
+            ],
+        ] as const)(
+            'restamps a malformed %s when a claim link is claimed',
+            async (_kind, template, field) => {
+                const before = Date.now();
+                await issueClaimLinkBoost(
+                    boostWith(template),
+                    options.domain,
+                    options.from,
+                    options.to,
+                    authority
+                );
+                const unsigned = mocks.signingAuthority.mock.calls[0]![1];
+                expectFreshDate(unsigned[field], before);
+            }
+        );
+
+        it('drops a stale issuanceDate left on a VC 2.0 template', async () => {
+            const before = Date.now();
+            await issueClaimLinkBoost(
+                boostWith({ '@context': V2, issuanceDate: MALFORMED_DATE }),
+                options.domain,
+                options.from,
+                options.to,
+                authority
+            );
+            const unsigned = mocks.signingAuthority.mock.calls[0]![1];
+            expectFreshDate(unsigned.validFrom, before);
+            expect(unsigned).not.toHaveProperty('issuanceDate');
+        });
+
+        it('drops a stale issuanceDate left on a VC 2.0 template for direct sends', async () => {
+            const before = Date.now();
+            const credential = await prepareCredentialFromBoost(
+                boostWith({ '@context': V2, issuanceDate: MALFORMED_DATE }),
+                `lc:network:network.example/boost:${BOOST_ID}`,
+                options.domain
+            );
+            expectFreshDate(credential.validFrom, before);
+            expect(credential).not.toHaveProperty('issuanceDate');
+        });
+
+        it.each([
+            { credentialSubject: { creditsEarned: 'not a number' } },
+            { awardedDate: 'bad-date' },
+        ])('reports invalid standard fields as BAD_REQUEST', async fields => {
+            await expect(
+                prepareCredentialFromBoost(
+                    boostWith({
+                        '@context': V2,
+                        type: ['VerifiableCredential', 'OpenBadgeCredential'],
+                        proof: undefined,
+                        ...fields,
+                    }),
+                    `lc:network:network.example/boost:${BOOST_ID}`,
+                    options.domain
+                )
+            ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        });
+
+        it.each(['', '  '])(
+            'omits blank awardedDate after template substitution %j',
+            async completed => {
+                const credential = await prepareCredentialFromBoost(
+                    boostWith({
+                        '@context': V2,
+                        type: ['VerifiableCredential', 'OpenBadgeCredential'],
+                        proof: undefined,
+                        awardedDate: '{{completed}}',
+                    }),
+                    `lc:network:network.example/boost:${BOOST_ID}`,
+                    options.domain,
+                    { templateData: { completed } }
+                );
+                expect(credential).not.toHaveProperty('awardedDate');
+            }
+        );
+
+        describe('stampIssuanceDate', () => {
+            const NOW = '2026-10-18T05:00:00.000Z';
+
+            it('sets validFrom and removes issuanceDate on VC 2.0', () => {
+                const stamped = stampIssuanceDate(
+                    {
+                        ...vc,
+                        '@context': V2,
+                        validFrom: MALFORMED_DATE,
+                        issuanceDate: MALFORMED_DATE,
+                    },
+                    NOW
+                );
+
+                expect(stamped.validFrom).toBe(NOW);
+                expect(stamped).not.toHaveProperty('issuanceDate');
+            });
+
+            it('only sets issuanceDate on VC 1.1', () => {
+                const template = { ...vc, '@context': V1, issuanceDate: MALFORMED_DATE };
+
+                expect(stampIssuanceDate({ ...template }, NOW)).toEqual({
+                    ...template,
+                    issuanceDate: NOW,
+                });
+            });
+        });
+    });
+
     it('preserves explicit notification and acceptance opt-outs', async () => {
         await sendBoost({
             ...options,

package/src/helpers/boost.helpers.ts

@@ -1,5 +1,10 @@
 import cloneDeep from 'lodash/cloneDeep';
-import { isEncrypted, isVC2Format } from '@learncard/helpers';
+import {
+    CredentialFieldError,
+    isEncrypted,
+    isVC2Format,
+    materializeCredentialFields,
+} from '@learncard/helpers';
 import { TRPCError } from '@trpc/server';
 import {
     VC,
@@ -87,6 +92,29 @@ export const isBoostViewableByClaimLink = async (boost: BoostInstance): Promise<
     return true;
 };
 
+/**
+ * Stamps the issuance time onto a credential built from a Boost template.
+ *
+ * A template's own issuanceDate/validFrom is when the template was written, not when this
+ * credential is issued, and templates created through the API are not date-validated: a
+ * malformed value (e.g. "2025-10-19+053008:18:16") makes DIDKit refuse to sign. VC 2.0
+ * templates get validFrom and lose any leftover issuanceDate, which the VC 2.0 context doesn't
+ * define (DIDKit rejects it as an undefined JSON-LD term). VC 1.1 templates get issuanceDate.
+ */
+export const stampIssuanceDate = <T extends UnsignedVC | VC>(
+    credential: T,
+    now: string = new Date().toISOString()
+): T => {
+    if (isVC2Format(credential)) {
+        credential.validFrom = now;
+        delete credential.issuanceDate;
+    } else {
+        credential.issuanceDate = now;
+    }
+
+    return credential;
+};
+
 export const convertCredentialToBoostTemplateJSON = (
     credential: VC | UnsignedVC,
     defaultIssuerDid?: string
@@ -255,6 +283,8 @@ export const issueClaimLinkBoost = async (
 
     boostCredential.issuer = signingAuthorityForUser.relationship.did;
 
+    stampIssuanceDate(boostCredential);
+
     setCredentialSubjectIds(boostCredential, getDidWeb(domain, to.profileId));
 
     // Embed the boostURI into the boost credential for verification purposes.
@@ -331,17 +361,20 @@ export const prepareCredentialFromBoost = async (
         boostJsonString = renderBoostTemplate(boostJsonString, mergedTemplateData);
     }
 
-    const credential = parseRenderedTemplate<UnsignedVC>(boostJsonString);
+    let credential: UnsignedVC;
+    try {
+        credential = materializeCredentialFields(
+            parseRenderedTemplate<UnsignedVC>(boostJsonString)
+        ) as UnsignedVC;
+    } catch (error) {
+        if (error instanceof CredentialFieldError)
+            throw new TRPCError({ code: 'BAD_REQUEST', message: error.message, cause: error });
+        throw error;
+    }
 
     appendTemplateEvidenceToCredential(credential, mergedTemplateData, allowAutoAppendEvidence);
 
-    // Set issuance date based on VC version
-    const now = new Date().toISOString();
-    if (isVC2Format(credential)) {
-        credential.validFrom = now;
-    } else {
-        credential.issuanceDate = now;
-    }
+    stampIssuanceDate(credential);
 
     // Set issuer if provided
     if (issuerDid) {
@@ -432,7 +465,16 @@ export const appendTemplateEvidenceToCredential = (
     // EvidenceFile subterms — otherwise the signer fails later with an opaque
     // JSON-LD key-expansion error. Surface a clear message instead so the
     // caller can prompt the user to republish the boost.
-    if (!credentialContextSupportsDynamicEvidence(credential)) {
+    const usesEvidenceExtensions = normalizedTemplateEvidence.some(item => {
+        if (!item || typeof item !== 'object') return false;
+        const evidence = item as Record<string, unknown>;
+        const types = Array.isArray(evidence.type) ? evidence.type : [evidence.type];
+        return (
+            types.includes('EvidenceFile') ||
+            ['fileName', 'fileType', 'fileSize'].some(key => key in evidence)
+        );
+    });
+    if (usesEvidenceExtensions && !credentialContextSupportsDynamicEvidence(credential)) {
         throw new TRPCError({
             code: 'PRECONDITION_FAILED',
             message:

package/src/models/credential-refresh-constraints.test.ts

@@ -77,4 +77,48 @@ describe('credential refresh constraint readiness', () => {
 
         expect(mocks.run).toHaveBeenCalledTimes(9);
     });
+
+    it('runs the constraint setup once per process across many calls', async () => {
+        mocks.run.mockResolvedValue(undefined);
+
+        const { ensureCredentialRefreshConstraints } =
+            await import('./credential-refresh-constraints');
+
+        // A burst of concurrent callers (cold start plus the first requests) ...
+        await Promise.all(Array.from({ length: 50 }, () => ensureCredentialRefreshConstraints()));
+        // ... and every later caller in the same process.
+        for (let i = 0; i < 200; i++) await ensureCredentialRefreshConstraints();
+
+        expect(mocks.run).toHaveBeenCalledTimes(8);
+        expect(new Set(mocks.run.mock.calls.map(([query]) => query)).size).toBe(8);
+    });
+
+    it('retries transient errors and deadlocks before giving up on a statement', async () => {
+        mocks.run
+            .mockRejectedValueOnce({ code: 'Neo.TransientError.Transaction.DeadlockDetected' })
+            .mockRejectedValueOnce({
+                code: 'Neo.TransientError.Transaction.LockClientStopped',
+                retriable: true,
+            })
+            .mockResolvedValue(undefined);
+
+        const { ensureCredentialRefreshConstraints } =
+            await import('./credential-refresh-constraints');
+
+        await expect(ensureCredentialRefreshConstraints()).resolves.toBeUndefined();
+        // The first statement took three attempts, the other seven one each
+        expect(mocks.run).toHaveBeenCalledTimes(10);
+        expect(mocks.run.mock.calls[0]![0]).toBe(mocks.run.mock.calls[2]![0]);
+    });
+
+    it('does not retry a non-transient failure', async () => {
+        const setupFailure = { code: 'Neo.ClientError.Security.Forbidden' };
+        mocks.run.mockRejectedValueOnce(setupFailure).mockResolvedValue(undefined);
+
+        const { ensureCredentialRefreshConstraints } =
+            await import('./credential-refresh-constraints');
+
+        await expect(ensureCredentialRefreshConstraints()).rejects.toBe(setupFailure);
+        expect(mocks.run).toHaveBeenCalledTimes(1);
+    });
 });

package/src/models/credential-refresh-constraints.ts

@@ -13,24 +13,50 @@ const CREDENTIAL_REFRESH_CONSTRAINT_QUERIES = [
 
 type Neo4jSchemaError = {
     code?: string;
+    retriable?: boolean;
 };
 
+const MAX_ATTEMPTS = 5;
+
+const wait = (ms: number): Promise<void> => new Promise(resolve => setTimeout(resolve, ms));
+
 const isEquivalentSchemaRuleRace = (error: unknown): boolean =>
     (error as Neo4jSchemaError | undefined)?.code ===
     'Neo.ClientError.Schema.EquivalentSchemaRuleAlreadyExists';
 
-const createCredentialRefreshConstraints = async (): Promise<void> => {
-    for (const query of CREDENTIAL_REFRESH_CONSTRAINT_QUERIES) {
+// Same retry rule as the index setup in models/index.ts: transient errors and deadlocks
+// (schema locks contended by other cold starts) are retried with a short backoff.
+const isRetriable = (error: unknown): boolean => {
+    const neo4jError = error as Neo4jSchemaError | undefined;
+
+    return (
+        neo4jError?.retriable === true ||
+        neo4jError?.code === 'Neo.TransientError.Transaction.DeadlockDetected'
+    );
+};
+
+const runConstraintQuery = async (query: string): Promise<void> => {
+    for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
         try {
             await neogma.queryRunner.run(query);
+            return;
         } catch (error) {
             // Concurrent service starts can both observe a missing rule before one wins
             // creation. The losing CREATE is equivalent to the desired ready state.
-            if (!isEquivalentSchemaRuleRace(error)) throw error;
+            if (isEquivalentSchemaRuleRace(error)) return;
+            if (!isRetriable(error) || attempt === MAX_ATTEMPTS) throw error;
+
+            await wait(100 * attempt);
         }
     }
 };
 
+const createCredentialRefreshConstraints = async (): Promise<void> => {
+    for (const query of CREDENTIAL_REFRESH_CONSTRAINT_QUERIES) {
+        await runConstraintQuery(query);
+    }
+};
+
 let constraintReadiness: Promise<void> | undefined;
 
 /**

package/src/models/index.ts

@@ -150,6 +150,8 @@ const indexQueries = [
     'CREATE INDEX profile_did_idx IF NOT EXISTS FOR (p:Profile) ON (p.did)',
     'CREATE TEXT INDEX profileId_text_idx IF NOT EXISTS FOR (n:Profile) ON (n.profileId)',
     'CREATE TEXT INDEX profile_displayname_text_idx IF NOT EXISTS FOR (n:Profile) ON (n.displayName)',
+    // Backs case-insensitive profile search (see accesslayer/profile/search-fields.ts)
+    'CREATE TEXT INDEX profile_displayname_lower_text_idx IF NOT EXISTS FOR (n:Profile) ON (n.displayNameLower)',
     'CREATE INDEX boost_id_idx IF NOT EXISTS FOR (b:Boost) ON (b.id)',
     'CREATE INDEX boost_category_idx IF NOT EXISTS FOR (b:Boost) ON (b.category)',
     'CREATE INDEX boost_autoconnect_idx IF NOT EXISTS FOR (b:Boost) ON (b.autoConnectRecipients)',
@@ -210,6 +212,10 @@ const indexQueries = [
     'CREATE INDEX contact_method_primary_idx IF NOT EXISTS FOR (c:ContactMethod) ON (c.isPrimary)',
     'CREATE INDEX credential_refresh_credential_id_idx IF NOT EXISTS FOR (r:CredentialRefresh) ON (r.credentialId)',
     'CREATE INDEX credential_refresh_version_refresh_id_idx IF NOT EXISTS FOR (c:Credential) ON (c.refreshId)',
+    // Credential activity reads join each CredentialActivity to its credential through
+    // (sender)-[:CREDENTIAL_SENT { activityId }]->(credential). Without this index every
+    // activity row scans all CREDENTIAL_SENT relationships.
+    'CREATE INDEX credential_sent_activity_id_idx IF NOT EXISTS FOR ()-[r:CREDENTIAL_SENT]-() ON (r.activityId)',
 ];
 
 const wait = (ms: number): Promise<void> => new Promise(resolve => setTimeout(resolve, ms));
@@ -240,11 +246,16 @@ const runIndexQuery = async (query: string): Promise<void> => {
 };
 
 if (shouldCreateIndices) {
-    void ensureCredentialRefreshConstraints().catch(err => {
-        console.error('Error creating credential refresh constraints:', err);
-    });
-
     (async function createIndices() {
+        // Constraints first, then indexes, one schema statement at a time. Running the two
+        // lists concurrently made every cold start contend with itself for schema locks.
+        // The readiness promise is memoized, so refresh routes awaiting it later reuse this run.
+        try {
+            await ensureCredentialRefreshConstraints();
+        } catch (err) {
+            console.error('Error creating credential refresh constraints:', err);
+        }
+
         try {
             for (const query of indexQueries) {
                 await runIndexQuery(query);

package/src/routes/workflows.ts

@@ -37,7 +37,12 @@ import { createClaimedRelationship } from '@accesslayer/inbox-credential/relatio
 import { getContactMethodById, getProfileByContactMethod } from '@accesslayer/contact-method/read';
 import { getProfileByDid, getProfileByProfileId } from '@accesslayer/profile/read';
 
-import { getBoostUri, isBoostViewableByClaimLink, isDraftBoost } from '@helpers/boost.helpers';
+import {
+    getBoostUri,
+    isBoostViewableByClaimLink,
+    isDraftBoost,
+    stampIssuanceDate,
+} from '@helpers/boost.helpers';
 import { getBoostOwnerProfile } from 'types/boost';
 import { getEmptyLearnCard, getLearnCard } from '@helpers/learnCard.helpers';
 import { issueCredentialWithSigningAuthority } from '@helpers/signingAuthority.helpers';
@@ -392,6 +397,8 @@ async function handlePresentationForClaim(
 
         boostCredential.issuer = signingAuthorityForUser.relationship.did;
 
+        stampIssuanceDate(boostCredential);
+
         if (Array.isArray(boostCredential.credentialSubject)) {
             boostCredential.credentialSubject = boostCredential.credentialSubject.map(subject => ({
                 ...subject,

package/src/seed/seedSkillFrameworks.ts

@@ -13,6 +13,8 @@ import {
     upsertSkillEmbeddings,
     type UpdateSkillEmbeddingFn,
 } from '@helpers/skill-embedding.helpers';
+import { syncProfileDisplayNameLower } from '../accesslayer/profile/search-fields';
+
 // Inlined from @helpers/profile.helpers to avoid importing the access/model layer
 // (it transitively pulls in @models, which hits a circular-dependency TDZ under tsx).
 const transformProfileId = (rawInput: string): string =>
@@ -519,7 +521,8 @@ export const ensureSeedProfile = async (
                        p.shortBio = coalesce(p.shortBio, $shortBio),
                        p.profileVisibility = coalesce(p.profileVisibility, $profileVisibility),
                        p.approved = coalesce(p.approved, $approved),
-                       p.isServiceProfile = coalesce(p.isServiceProfile, $isServiceProfile)`,
+                       p.isServiceProfile = coalesce(p.isServiceProfile, $isServiceProfile)
+         SET ${syncProfileDisplayNameLower('p')}`,
         {
             profileId: normalizedProfileId,
             displayName: DEFAULT_OWNER_DISPLAY_NAME,