@learncard/network-brain-service 4.0.3 → 4.0.4

package/dist/routes/workflows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../../src/routes/workflows.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAgB,OAAO,EAAE,MAAM,SAAS,CAAC;AAuFhD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqF1B,CAAC;AA8uBH,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC"}
+{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../../src/routes/workflows.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAgB,OAAO,EAAE,MAAM,SAAS,CAAC;AA4FhD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqF1B,CAAC;AAgvBH,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC"}

package/esbuildPlugins.cjs

@@ -2,6 +2,7 @@ const path = require('node:path');
 const fs = require('node:fs');
 
 const { sentryEsbuildPlugin } = require('@sentry/esbuild-plugin');
+const { withSentryRateLimitRetry } = require('../../../scripts/sentry-rate-limit-retry.cjs');
 
 const forceCjsSodiumWrapperPlugin = {
     name: 'force-cjs-sodium-wrapper',
@@ -40,10 +41,12 @@ const copyDidkitWasmPlugin = {
 module.exports = [
     forceCjsSodiumWrapperPlugin,
     copyDidkitWasmPlugin,
-    sentryEsbuildPlugin({
-        telemetry: process.env.SENTRY_BUILD_TELEMETRY !== 'false',
-        authToken: process.env.SENTRY_AUTH_TOKEN,
-        org: process.env.SENTRY_ORG,
-        project: process.env.SENTRY_PROJECT,
-    }),
+    withSentryRateLimitRetry(
+        sentryEsbuildPlugin({
+            telemetry: process.env.SENTRY_BUILD_TELEMETRY !== 'false',
+            authToken: process.env.SENTRY_AUTH_TOKEN,
+            org: process.env.SENTRY_ORG,
+            project: process.env.SENTRY_PROJECT,
+        })
+    ),
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@learncard/network-brain-service",
-    "version": "4.0.3",
+    "version": "4.0.4",
     "description": "",
     "engines": {
         "node": ">=24.12 <25"
@@ -65,23 +65,23 @@
         "@digitalcredentials/issuer-registry-client": "^4.1.0",
         "@fastify/cors": "^11.2.0",
         "@google/genai": "^1.27.0",
-        "@learncard/credential-library": "2.1.2",
-        "@learncard/core": "9.4.39",
-        "@learncard/crypto-plugin": "1.1.39",
-        "@learncard/did-web-plugin": "1.1.39",
-        "@learncard/didkey-plugin": "1.1.39",
-        "@learncard/didkit-plugin": "1.10.4",
-        "@learncard/didkit-plugin-node": "0.3.4",
-        "@learncard/dynamic-loader-plugin": "1.1.39",
-        "@learncard/encryption-plugin": "1.1.39",
-        "@learncard/expiration-plugin": "1.2.39",
+        "@learncard/credential-library": "2.1.3",
+        "@learncard/core": "9.4.40",
+        "@learncard/crypto-plugin": "1.1.40",
+        "@learncard/did-web-plugin": "1.1.40",
+        "@learncard/didkey-plugin": "1.1.40",
+        "@learncard/didkit-plugin": "1.10.5",
+        "@learncard/didkit-plugin-node": "0.3.5",
+        "@learncard/dynamic-loader-plugin": "1.1.40",
+        "@learncard/encryption-plugin": "1.1.40",
+        "@learncard/expiration-plugin": "1.2.40",
         "@learncard/email-templates": "1.2.1",
-        "@learncard/helpers": "1.6.3",
-        "@learncard/learn-card-plugin": "1.2.39",
+        "@learncard/helpers": "1.7.0",
+        "@learncard/learn-card-plugin": "1.2.40",
         "@learncard/partner-connect-core": "0.2.0",
-        "@learncard/types": "5.23.1",
-        "@learncard/vc-plugin": "1.6.5",
-        "@learncard/vc-templates-plugin": "1.1.39",
+        "@learncard/types": "5.23.2",
+        "@learncard/vc-plugin": "1.6.6",
+        "@learncard/vc-templates-plugin": "1.1.40",
         "@sentry/serverless": "7.61.0",
         "@trpc/server": "11.8.0",
         "@types/lodash": "^4.14.191",

package/src/accesslayer/consentflowcontract/relationships/create.ts

@@ -21,7 +21,7 @@ import { BoostType } from 'types/boost';
 import { flattenObject, inflateObject } from '@helpers/objects.helpers';
 import { convertQueryResultToPropertiesObjectArray } from '@helpers/neo4j.helpers';
 import { reconsentTerms } from './update';
-import { getBoostUri, sendBoost } from '@helpers/boost.helpers';
+import { getBoostUri, sendBoost, stampIssuanceDate } from '@helpers/boost.helpers';
 import { setCredentialSubjectIds } from '@helpers/credentialSubject.helpers';
 import { getDidWeb } from '@helpers/did.helpers';
 import { getSigningAuthorityForUserByName } from '@accesslayer/signing-authority/relationships/read';
@@ -296,6 +296,8 @@ export const consentToContract = async (
 
                     boostCredential.issuer = { id: contractOwnerSigningAuthority.relationship.did };
 
+                    stampIssuanceDate(boostCredential);
+
                     if (boostCredential.type.includes('BoostCredential')) {
                         boostCredential.boostId = getBoostUri(boost.target.id, domain);
                     }

package/src/accesslayer/consentflowcontract/relationships/update.ts

@@ -15,7 +15,7 @@ import { ConsentFlowTerms, ConsentFlowTransaction, ConsentFlowContract } from '@
 import { neogma } from '@instance';
 import { flattenObject } from '@helpers/objects.helpers';
 import { DbContractType, DbTermsType } from 'types/consentflowcontract';
-import { getBoostUri, sendBoost } from '@helpers/boost.helpers';
+import { getBoostUri, sendBoost, stampIssuanceDate } from '@helpers/boost.helpers';
 import { setCredentialSubjectIds } from '@helpers/credentialSubject.helpers';
 import { getDidWeb } from '@helpers/did.helpers';
 import { getSigningAuthorityForUserByName } from '@accesslayer/signing-authority/relationships/read';
@@ -201,6 +201,8 @@ export const reconsentTerms = async (
                     // Set the issuer and subject
                     boostCredential.issuer = { id: contractOwnerSigningAuthority.relationship.did };
 
+                    stampIssuanceDate(boostCredential);
+
                     if (boostCredential.type.includes('BoostCredential')) {
                         boostCredential.boostId = getBoostUri(boost.dataValues.id, domain);
                     }
@@ -439,6 +441,8 @@ export const updateTerms = async (
                     // Set the issuer and subject
                     boostCredential.issuer = { id: contractOwnerSigningAuthority.relationship.did };
 
+                    stampIssuanceDate(boostCredential);
+
                     if (boostCredential.type.includes('BoostCredential')) {
                         boostCredential.boostId = getBoostUri(boost.target.id, domain);
                     }

package/src/accesslayer/inbox-batch/schema.test.ts

@@ -0,0 +1,91 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type { Driver, ManagedTransaction } from 'neo4j-driver';
+
+vi.mock('@instance', () => ({ neogma: { driver: { session: vi.fn() } } }));
+import { createInboxBatchSchemaInitializer } from './schema';
+
+const harness = () => {
+    const run = vi.fn().mockResolvedValue({});
+    const close = vi.fn().mockResolvedValue(undefined);
+    const executeWrite = vi.fn(async (callback: (tx: ManagedTransaction) => unknown) =>
+        callback({ run } as unknown as ManagedTransaction)
+    );
+    const driver = { session: vi.fn(() => ({ run: vi.fn(), executeWrite, close })) };
+    const ensure = createInboxBatchSchemaInitializer(driver as unknown as Driver);
+    return { run, close, executeWrite, driver, ensure };
+};
+
+beforeEach(() => vi.clearAllMocks());
+
+describe('inbox batch schema readiness', () => {
+    it('shares in-flight readiness and runs every constraint AND index in its own managed write', async () => {
+        const { ensure, driver, executeWrite, run, close } = harness();
+        const first = ensure();
+        expect(ensure()).toBe(first);
+        await first;
+        await ensure();
+        expect(driver.session).toHaveBeenCalledTimes(1);
+        expect(executeWrite).toHaveBeenCalledTimes(10);
+        expect(run).toHaveBeenCalledTimes(10);
+        expect(
+            run.mock.calls.filter(([query]) => query.startsWith('CREATE CONSTRAINT'))
+        ).toHaveLength(4);
+        expect(run.mock.calls.filter(([query]) => query.startsWith('CREATE INDEX'))).toHaveLength(
+            6
+        );
+        expect(close).toHaveBeenCalledTimes(1);
+    });
+
+    it('lets independent API/worker initializers complete through a transient managed-transaction retry', async () => {
+        const api = harness();
+        const worker = harness();
+        // Model the driver re-entering the transaction callback after a DDL deadlock.
+        // The real-driver concurrent cold-start regression lives in inbox-batch.spec.ts.
+        const deadlock = { code: 'Neo.TransientError.Transaction.DeadlockDetected' };
+        api.run.mockRejectedValueOnce(deadlock);
+        api.executeWrite.mockImplementationOnce(async callback => {
+            await expect(callback({ run: api.run } as unknown as ManagedTransaction)).rejects.toBe(
+                deadlock
+            );
+            return callback({ run: api.run } as unknown as ManagedTransaction);
+        });
+        await expect(Promise.all([api.ensure(), worker.ensure()])).resolves.toEqual([
+            undefined,
+            undefined,
+        ]);
+        const firstQuery =
+            'CREATE CONSTRAINT inboxbatch_id IF NOT EXISTS FOR (n:InboxBatch) REQUIRE n.id IS UNIQUE';
+        expect(api.run.mock.calls.slice(0, 2)).toEqual([[firstQuery], [firstQuery]]);
+        expect(api.run).toHaveBeenCalledTimes(11);
+        expect(worker.run).toHaveBeenCalledTimes(10);
+    });
+
+    it.each([0, 4])('accepts equivalent-schema races for statement %i', async position => {
+        const { ensure, run } = harness();
+        for (let index = 0; index < position; index++) run.mockResolvedValueOnce({});
+        run.mockRejectedValueOnce({
+            code: 'Neo.ClientError.Schema.EquivalentSchemaRuleAlreadyExists',
+        });
+        await expect(ensure()).resolves.toBeUndefined();
+        expect(run).toHaveBeenCalledTimes(10);
+    });
+
+    it.each([
+        'Neo.ClientError.Security.Forbidden',
+        'Neo.TransientError.Transaction.DeadlockDetected',
+    ])(
+        'propagates %s after the managed write fails and allows a later readiness attempt',
+        async code => {
+            const { ensure, executeWrite, run, close, driver } = harness();
+            const failure = { code };
+            executeWrite.mockRejectedValueOnce(failure);
+            await expect(ensure()).rejects.toBe(failure);
+            expect(run).not.toHaveBeenCalled();
+            expect(close).toHaveBeenCalledTimes(1);
+            await expect(ensure()).resolves.toBeUndefined();
+            expect(driver.session).toHaveBeenCalledTimes(2);
+            expect(run).toHaveBeenCalledTimes(10);
+            expect(close).toHaveBeenCalledTimes(2);
+        }
+    );
+});

package/src/accesslayer/inbox-batch/schema.ts

@@ -0,0 +1,54 @@
+import type { Driver } from 'neo4j-driver';
+import { neogma } from '@instance';
+
+const SCHEMA_QUERIES = [
+    ...['InboxBatch', 'InboxBatchItem', 'InboxBatchIssuer', 'InboxBatchReplay'].map(
+        label =>
+            `CREATE CONSTRAINT ${label.toLowerCase()}_id IF NOT EXISTS FOR (n:${label}) REQUIRE n.id IS UNIQUE`
+    ),
+    'CREATE INDEX inbox_batch_request IF NOT EXISTS FOR (b:InboxBatch) ON (b.issuer, b.requestId)',
+    'CREATE INDEX inbox_batch_dispatch IF NOT EXISTS FOR (i:InboxBatchItem) ON (i.state, i.dispatchAt)',
+    'CREATE INDEX inbox_batch_recovery IF NOT EXISTS FOR (i:InboxBatchItem) ON (i.state, i.leaseUntil)',
+    'CREATE INDEX inbox_batch_replay_owner IF NOT EXISTS FOR (r:InboxBatchReplay) ON (r.itemId)',
+    'CREATE INDEX inbox_batch_completed IF NOT EXISTS FOR (b:InboxBatch) ON (b.completedAt)',
+    'CREATE INDEX inbox_batch_replay_expiry IF NOT EXISTS FOR (r:InboxBatchReplay) ON (r.expiresAt)',
+];
+
+/** Each API/worker process shares readiness locally; the driver retries cross-process DDL deadlocks. */
+export const createInboxBatchSchemaInitializer = (
+    driver: Pick<Driver, 'session'>
+): (() => Promise<void>) => {
+    let readiness: Promise<void> | undefined;
+    return (): Promise<void> => {
+        if (!readiness) {
+            const pending = (async (): Promise<void> => {
+                const session = driver.session();
+                try {
+                    for (const query of SCHEMA_QUERIES) {
+                        try {
+                            // One schema statement per managed transaction. IF NOT EXISTS is
+                            // idempotent, but competing cold processes can still deadlock while
+                            // acquiring label locks. Auto-commit queryRunner.run does not retry.
+                            await session.executeWrite(tx => tx.run(query));
+                        } catch (error) {
+                            if (
+                                (error as { code?: string } | null)?.code !==
+                                'Neo.ClientError.Schema.EquivalentSchemaRuleAlreadyExists'
+                            )
+                                throw error;
+                        }
+                    }
+                } finally {
+                    await session.close();
+                }
+            })();
+            readiness = pending;
+            void pending.catch(() => {
+                if (readiness === pending) readiness = undefined;
+            });
+        }
+        return readiness;
+    };
+};
+
+export const ensureInboxBatchConstraints = createInboxBatchSchemaInitializer(neogma.driver);

package/src/accesslayer/inbox-batch/store.ts

@@ -6,49 +6,13 @@ import { neogma } from '@instance';
 import { encryptInboxCredential, decryptInboxCredential } from '@helpers/inbox-encryption.helpers';
 import type { BatchItem, BatchJob, BatchReplayStore, InboxDispatchLease } from 'types/inbox-batch';
 import { getInboxBatchState } from '@helpers/inbox-batch-status.helpers';
+import { ensureInboxBatchConstraints } from './schema';
 
 export const DAY = 86_400_000;
 export const LEASE_MS = 360_000;
 const CLEANUP_MARGIN_MS = 5_000;
 
-let readiness: Promise<void> | undefined;
-export const ensureInboxBatchConstraints = (): Promise<void> => {
-    if (!readiness) {
-        readiness = (async () => {
-            for (const label of [
-                'InboxBatch',
-                'InboxBatchItem',
-                'InboxBatchIssuer',
-                'InboxBatchReplay',
-            ]) {
-                try {
-                    await neogma.queryRunner.run(
-                        `CREATE CONSTRAINT ${label.toLowerCase()}_id IF NOT EXISTS FOR (n:${label}) REQUIRE n.id IS UNIQUE`
-                    );
-                } catch (error) {
-                    if (
-                        (error as { code?: string }).code !==
-                        'Neo.ClientError.Schema.EquivalentSchemaRuleAlreadyExists'
-                    )
-                        throw error;
-                }
-            }
-            for (const query of [
-                'CREATE INDEX inbox_batch_request IF NOT EXISTS FOR (b:InboxBatch) ON (b.issuer, b.requestId)',
-                'CREATE INDEX inbox_batch_dispatch IF NOT EXISTS FOR (i:InboxBatchItem) ON (i.state, i.dispatchAt)',
-                'CREATE INDEX inbox_batch_recovery IF NOT EXISTS FOR (i:InboxBatchItem) ON (i.state, i.leaseUntil)',
-                'CREATE INDEX inbox_batch_replay_owner IF NOT EXISTS FOR (r:InboxBatchReplay) ON (r.itemId)',
-                'CREATE INDEX inbox_batch_completed IF NOT EXISTS FOR (b:InboxBatch) ON (b.completedAt)',
-                'CREATE INDEX inbox_batch_replay_expiry IF NOT EXISTS FOR (r:InboxBatchReplay) ON (r.expiresAt)',
-            ])
-                await neogma.queryRunner.run(query);
-        })();
-        void readiness.catch(() => {
-            readiness = undefined;
-        });
-    }
-    return readiness;
-};
+export { ensureInboxBatchConstraints } from './schema';
 
 const transaction = async <T>(fn: (tx: ManagedTransaction) => Promise<T>): Promise<T> => {
     await ensureInboxBatchConstraints();

package/src/helpers/boost-storage.helpers.test.ts

@@ -65,7 +65,12 @@ vi.mock('@tracing', () => ({
     traceInternal: async (_name: string, action: () => unknown) => action(),
 }));
 
-import { issueClaimLinkBoost, sendBoost } from './boost.helpers';
+import {
+    issueClaimLinkBoost,
+    prepareCredentialFromBoost,
+    sendBoost,
+    stampIssuanceDate,
+} from './boost.helpers';
 
 const vc = {
     '@context': ['https://www.w3.org/2018/credentials/v1'],
@@ -223,6 +228,155 @@ describe('boost payload storage', () => {
         }
     );
 
+    describe('malformed template issuance dates', () => {
+        // Seen on a production Boost template; it is not RFC 3339, so DIDKit refuses to sign it.
+        const MALFORMED_DATE = '2025-10-19+053008:18:16';
+        // The reused JOTA-JOTI "Health and Well-being" Boost that carried it.
+        const BOOST_ID = 'e073d183-8304-419f-b4f6-ef91fda6524c';
+        const V1 = ['https://www.w3.org/2018/credentials/v1'];
+        const V2 = ['https://www.w3.org/ns/credentials/v2'];
+        const authority = { relationship: { did: 'did:example:sa' } } as Parameters<
+            typeof issueClaimLinkBoost
+        >[4];
+        const boostWith = (template: Record<string, unknown>) =>
+            ({
+                ...options.boost,
+                dataValues: {
+                    id: BOOST_ID,
+                    boost: JSON.stringify({ ...vc, boostId: undefined, ...template }),
+                },
+            }) as Parameters<typeof issueClaimLinkBoost>[0];
+        const expectFreshDate = (value: unknown, before: number) => {
+            expect(typeof value).toBe('string');
+            expect(value).toBe(new Date(value as string).toISOString());
+            expect(Date.parse(value as string)).toBeGreaterThanOrEqual(before);
+        };
+
+        beforeEach(() => {
+            mocks.signingAuthority.mockResolvedValue({
+                kind: 'issued-credential',
+                credential: jwe,
+                statusEntries: [],
+            });
+        });
+
+        it.each([
+            [
+                'VC 1.1 issuanceDate',
+                { '@context': V1, issuanceDate: MALFORMED_DATE },
+                'issuanceDate',
+            ],
+            [
+                'VC 2.0 validFrom',
+                { '@context': V2, issuanceDate: undefined, validFrom: MALFORMED_DATE },
+                'validFrom',
+            ],
+        ] as const)(
+            'restamps a malformed %s when a claim link is claimed',
+            async (_kind, template, field) => {
+                const before = Date.now();
+                await issueClaimLinkBoost(
+                    boostWith(template),
+                    options.domain,
+                    options.from,
+                    options.to,
+                    authority
+                );
+                const unsigned = mocks.signingAuthority.mock.calls[0]![1];
+                expectFreshDate(unsigned[field], before);
+            }
+        );
+
+        it('drops a stale issuanceDate left on a VC 2.0 template', async () => {
+            const before = Date.now();
+            await issueClaimLinkBoost(
+                boostWith({ '@context': V2, issuanceDate: MALFORMED_DATE }),
+                options.domain,
+                options.from,
+                options.to,
+                authority
+            );
+            const unsigned = mocks.signingAuthority.mock.calls[0]![1];
+            expectFreshDate(unsigned.validFrom, before);
+            expect(unsigned).not.toHaveProperty('issuanceDate');
+        });
+
+        it('drops a stale issuanceDate left on a VC 2.0 template for direct sends', async () => {
+            const before = Date.now();
+            const credential = await prepareCredentialFromBoost(
+                boostWith({ '@context': V2, issuanceDate: MALFORMED_DATE }),
+                `lc:network:network.example/boost:${BOOST_ID}`,
+                options.domain
+            );
+            expectFreshDate(credential.validFrom, before);
+            expect(credential).not.toHaveProperty('issuanceDate');
+        });
+
+        it.each([
+            { credentialSubject: { creditsEarned: 'not a number' } },
+            { awardedDate: 'bad-date' },
+        ])('reports invalid standard fields as BAD_REQUEST', async fields => {
+            await expect(
+                prepareCredentialFromBoost(
+                    boostWith({
+                        '@context': V2,
+                        type: ['VerifiableCredential', 'OpenBadgeCredential'],
+                        proof: undefined,
+                        ...fields,
+                    }),
+                    `lc:network:network.example/boost:${BOOST_ID}`,
+                    options.domain
+                )
+            ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        });
+
+        it.each(['', '  '])(
+            'omits blank awardedDate after template substitution %j',
+            async completed => {
+                const credential = await prepareCredentialFromBoost(
+                    boostWith({
+                        '@context': V2,
+                        type: ['VerifiableCredential', 'OpenBadgeCredential'],
+                        proof: undefined,
+                        awardedDate: '{{completed}}',
+                    }),
+                    `lc:network:network.example/boost:${BOOST_ID}`,
+                    options.domain,
+                    { templateData: { completed } }
+                );
+                expect(credential).not.toHaveProperty('awardedDate');
+            }
+        );
+
+        describe('stampIssuanceDate', () => {
+            const NOW = '2026-10-18T05:00:00.000Z';
+
+            it('sets validFrom and removes issuanceDate on VC 2.0', () => {
+                const stamped = stampIssuanceDate(
+                    {
+                        ...vc,
+                        '@context': V2,
+                        validFrom: MALFORMED_DATE,
+                        issuanceDate: MALFORMED_DATE,
+                    },
+                    NOW
+                );
+
+                expect(stamped.validFrom).toBe(NOW);
+                expect(stamped).not.toHaveProperty('issuanceDate');
+            });
+
+            it('only sets issuanceDate on VC 1.1', () => {
+                const template = { ...vc, '@context': V1, issuanceDate: MALFORMED_DATE };
+
+                expect(stampIssuanceDate({ ...template }, NOW)).toEqual({
+                    ...template,
+                    issuanceDate: NOW,
+                });
+            });
+        });
+    });
+
     it('preserves explicit notification and acceptance opt-outs', async () => {
         await sendBoost({
             ...options,

package/src/helpers/boost.helpers.ts

@@ -1,5 +1,10 @@
 import cloneDeep from 'lodash/cloneDeep';
-import { isEncrypted, isVC2Format } from '@learncard/helpers';
+import {
+    CredentialFieldError,
+    isEncrypted,
+    isVC2Format,
+    materializeCredentialFields,
+} from '@learncard/helpers';
 import { TRPCError } from '@trpc/server';
 import {
     VC,
@@ -87,6 +92,29 @@ export const isBoostViewableByClaimLink = async (boost: BoostInstance): Promise<
     return true;
 };
 
+/**
+ * Stamps the issuance time onto a credential built from a Boost template.
+ *
+ * A template's own issuanceDate/validFrom is when the template was written, not when this
+ * credential is issued, and templates created through the API are not date-validated: a
+ * malformed value (e.g. "2025-10-19+053008:18:16") makes DIDKit refuse to sign. VC 2.0
+ * templates get validFrom and lose any leftover issuanceDate, which the VC 2.0 context doesn't
+ * define (DIDKit rejects it as an undefined JSON-LD term). VC 1.1 templates get issuanceDate.
+ */
+export const stampIssuanceDate = <T extends UnsignedVC | VC>(
+    credential: T,
+    now: string = new Date().toISOString()
+): T => {
+    if (isVC2Format(credential)) {
+        credential.validFrom = now;
+        delete credential.issuanceDate;
+    } else {
+        credential.issuanceDate = now;
+    }
+
+    return credential;
+};
+
 export const convertCredentialToBoostTemplateJSON = (
     credential: VC | UnsignedVC,
     defaultIssuerDid?: string
@@ -255,6 +283,8 @@ export const issueClaimLinkBoost = async (
 
     boostCredential.issuer = signingAuthorityForUser.relationship.did;
 
+    stampIssuanceDate(boostCredential);
+
     setCredentialSubjectIds(boostCredential, getDidWeb(domain, to.profileId));
 
     // Embed the boostURI into the boost credential for verification purposes.
@@ -331,17 +361,20 @@ export const prepareCredentialFromBoost = async (
         boostJsonString = renderBoostTemplate(boostJsonString, mergedTemplateData);
     }
 
-    const credential = parseRenderedTemplate<UnsignedVC>(boostJsonString);
+    let credential: UnsignedVC;
+    try {
+        credential = materializeCredentialFields(
+            parseRenderedTemplate<UnsignedVC>(boostJsonString)
+        ) as UnsignedVC;
+    } catch (error) {
+        if (error instanceof CredentialFieldError)
+            throw new TRPCError({ code: 'BAD_REQUEST', message: error.message, cause: error });
+        throw error;
+    }
 
     appendTemplateEvidenceToCredential(credential, mergedTemplateData, allowAutoAppendEvidence);
 
-    // Set issuance date based on VC version
-    const now = new Date().toISOString();
-    if (isVC2Format(credential)) {
-        credential.validFrom = now;
-    } else {
-        credential.issuanceDate = now;
-    }
+    stampIssuanceDate(credential);
 
     // Set issuer if provided
     if (issuerDid) {
@@ -432,7 +465,16 @@ export const appendTemplateEvidenceToCredential = (
     // EvidenceFile subterms — otherwise the signer fails later with an opaque
     // JSON-LD key-expansion error. Surface a clear message instead so the
     // caller can prompt the user to republish the boost.
-    if (!credentialContextSupportsDynamicEvidence(credential)) {
+    const usesEvidenceExtensions = normalizedTemplateEvidence.some(item => {
+        if (!item || typeof item !== 'object') return false;
+        const evidence = item as Record<string, unknown>;
+        const types = Array.isArray(evidence.type) ? evidence.type : [evidence.type];
+        return (
+            types.includes('EvidenceFile') ||
+            ['fileName', 'fileType', 'fileSize'].some(key => key in evidence)
+        );
+    });
+    if (usesEvidenceExtensions && !credentialContextSupportsDynamicEvidence(credential)) {
         throw new TRPCError({
             code: 'PRECONDITION_FAILED',
             message:

package/src/routes/workflows.ts

@@ -37,7 +37,12 @@ import { createClaimedRelationship } from '@accesslayer/inbox-credential/relatio
 import { getContactMethodById, getProfileByContactMethod } from '@accesslayer/contact-method/read';
 import { getProfileByDid, getProfileByProfileId } from '@accesslayer/profile/read';
 
-import { getBoostUri, isBoostViewableByClaimLink, isDraftBoost } from '@helpers/boost.helpers';
+import {
+    getBoostUri,
+    isBoostViewableByClaimLink,
+    isDraftBoost,
+    stampIssuanceDate,
+} from '@helpers/boost.helpers';
 import { getBoostOwnerProfile } from 'types/boost';
 import { getEmptyLearnCard, getLearnCard } from '@helpers/learnCard.helpers';
 import { issueCredentialWithSigningAuthority } from '@helpers/signingAuthority.helpers';
@@ -392,6 +397,8 @@ async function handlePresentationForClaim(
 
         boostCredential.issuer = signingAuthorityForUser.relationship.did;
 
+        stampIssuanceDate(boostCredential);
+
         if (Array.isArray(boostCredential.credentialSubject)) {
             boostCredential.credentialSubject = boostCredential.credentialSubject.map(subject => ({
                 ...subject,