@learncard/network-brain-service 4.0.3 → 4.1.0

package/src/helpers/bedrock-embedding.smoke.test.ts

@@ -0,0 +1,53 @@
+/**
+ * LC-2206 opt-in smoke test against REAL Amazon Bedrock (paid: three InvokeModel calls).
+ * Skipped unless SKILL_EMBEDDING_BEDROCK_SMOKE=true. Never enable it in CI.
+ *
+ *   SKILL_EMBEDDING_BEDROCK_SMOKE=true AWS_PROFILE=<profile> \
+ *     bunx vitest run --config vitest.config.ts src/helpers/bedrock-embedding.smoke.test.ts
+ *
+ * Uses the normal AWS credential chain (SigV4) in us-east-1 and the same request shape,
+ * purposes, dimension and normalisation as production.
+ */
+import { describe, expect, it } from 'vitest';
+
+import {
+    DEFAULT_SKILL_EMBEDDING_DIMENSION,
+    DEFAULT_SKILL_EMBEDDING_REGION,
+    NOVA2_EMBEDDING_MODEL_ID,
+} from '../config/skillEmbedding';
+import { embedTextWithBedrock, type BedrockEmbeddingConfig } from './bedrock-embedding.helpers';
+
+const enabled = process.env.SKILL_EMBEDDING_BEDROCK_SMOKE === 'true';
+
+const config: BedrockEmbeddingConfig = {
+    modelId: process.env.SKILL_EMBEDDING_BEDROCK_MODEL_ID || NOVA2_EMBEDDING_MODEL_ID,
+    region: process.env.SKILL_EMBEDDING_BEDROCK_REGION || DEFAULT_SKILL_EMBEDDING_REGION,
+    dimension: Number(process.env.SKILL_EMBEDDING_DIMENSION || DEFAULT_SKILL_EMBEDDING_DIMENSION),
+    timeoutMs: 15_000,
+};
+
+const dot = (a: number[], b: number[]) =>
+    a.reduce((sum, value, index) => sum + value * (b[index] ?? 0), 0);
+
+describe.skipIf(!enabled)('Bedrock Nova 2 embeddings smoke (real AWS, opt-in)', () => {
+    it('returns unit vectors where a related skill outranks an unrelated one', async () => {
+        const query = await embedTextWithBedrock('python data analysis', 'query', config);
+        const related = await embedTextWithBedrock(
+            'Data Analysis\nAnalyse datasets with Python and statistics',
+            'index',
+            config
+        );
+        const unrelated = await embedTextWithBedrock(
+            'Customer service\nHelp customers resolve issues politely',
+            'index',
+            config
+        );
+
+        for (const vector of [query, related, unrelated]) {
+            expect(vector).toHaveLength(config.dimension);
+            expect(Math.hypot(...vector)).toBeCloseTo(1, 6);
+        }
+
+        expect(dot(query, related)).toBeGreaterThan(dot(query, unrelated));
+    }, 60_000);
+});

package/src/helpers/boost-storage.helpers.test.ts

@@ -65,7 +65,12 @@ vi.mock('@tracing', () => ({
     traceInternal: async (_name: string, action: () => unknown) => action(),
 }));
 
-import { issueClaimLinkBoost, sendBoost } from './boost.helpers';
+import {
+    issueClaimLinkBoost,
+    prepareCredentialFromBoost,
+    sendBoost,
+    stampIssuanceDate,
+} from './boost.helpers';
 
 const vc = {
     '@context': ['https://www.w3.org/2018/credentials/v1'],
@@ -223,6 +228,155 @@ describe('boost payload storage', () => {
         }
     );
 
+    describe('malformed template issuance dates', () => {
+        // Seen on a production Boost template; it is not RFC 3339, so DIDKit refuses to sign it.
+        const MALFORMED_DATE = '2025-10-19+053008:18:16';
+        // The reused JOTA-JOTI "Health and Well-being" Boost that carried it.
+        const BOOST_ID = 'e073d183-8304-419f-b4f6-ef91fda6524c';
+        const V1 = ['https://www.w3.org/2018/credentials/v1'];
+        const V2 = ['https://www.w3.org/ns/credentials/v2'];
+        const authority = { relationship: { did: 'did:example:sa' } } as Parameters<
+            typeof issueClaimLinkBoost
+        >[4];
+        const boostWith = (template: Record<string, unknown>) =>
+            ({
+                ...options.boost,
+                dataValues: {
+                    id: BOOST_ID,
+                    boost: JSON.stringify({ ...vc, boostId: undefined, ...template }),
+                },
+            }) as Parameters<typeof issueClaimLinkBoost>[0];
+        const expectFreshDate = (value: unknown, before: number) => {
+            expect(typeof value).toBe('string');
+            expect(value).toBe(new Date(value as string).toISOString());
+            expect(Date.parse(value as string)).toBeGreaterThanOrEqual(before);
+        };
+
+        beforeEach(() => {
+            mocks.signingAuthority.mockResolvedValue({
+                kind: 'issued-credential',
+                credential: jwe,
+                statusEntries: [],
+            });
+        });
+
+        it.each([
+            [
+                'VC 1.1 issuanceDate',
+                { '@context': V1, issuanceDate: MALFORMED_DATE },
+                'issuanceDate',
+            ],
+            [
+                'VC 2.0 validFrom',
+                { '@context': V2, issuanceDate: undefined, validFrom: MALFORMED_DATE },
+                'validFrom',
+            ],
+        ] as const)(
+            'restamps a malformed %s when a claim link is claimed',
+            async (_kind, template, field) => {
+                const before = Date.now();
+                await issueClaimLinkBoost(
+                    boostWith(template),
+                    options.domain,
+                    options.from,
+                    options.to,
+                    authority
+                );
+                const unsigned = mocks.signingAuthority.mock.calls[0]![1];
+                expectFreshDate(unsigned[field], before);
+            }
+        );
+
+        it('drops a stale issuanceDate left on a VC 2.0 template', async () => {
+            const before = Date.now();
+            await issueClaimLinkBoost(
+                boostWith({ '@context': V2, issuanceDate: MALFORMED_DATE }),
+                options.domain,
+                options.from,
+                options.to,
+                authority
+            );
+            const unsigned = mocks.signingAuthority.mock.calls[0]![1];
+            expectFreshDate(unsigned.validFrom, before);
+            expect(unsigned).not.toHaveProperty('issuanceDate');
+        });
+
+        it('drops a stale issuanceDate left on a VC 2.0 template for direct sends', async () => {
+            const before = Date.now();
+            const credential = await prepareCredentialFromBoost(
+                boostWith({ '@context': V2, issuanceDate: MALFORMED_DATE }),
+                `lc:network:network.example/boost:${BOOST_ID}`,
+                options.domain
+            );
+            expectFreshDate(credential.validFrom, before);
+            expect(credential).not.toHaveProperty('issuanceDate');
+        });
+
+        it.each([
+            { credentialSubject: { creditsEarned: 'not a number' } },
+            { awardedDate: 'bad-date' },
+        ])('reports invalid standard fields as BAD_REQUEST', async fields => {
+            await expect(
+                prepareCredentialFromBoost(
+                    boostWith({
+                        '@context': V2,
+                        type: ['VerifiableCredential', 'OpenBadgeCredential'],
+                        proof: undefined,
+                        ...fields,
+                    }),
+                    `lc:network:network.example/boost:${BOOST_ID}`,
+                    options.domain
+                )
+            ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        });
+
+        it.each(['', '  '])(
+            'omits blank awardedDate after template substitution %j',
+            async completed => {
+                const credential = await prepareCredentialFromBoost(
+                    boostWith({
+                        '@context': V2,
+                        type: ['VerifiableCredential', 'OpenBadgeCredential'],
+                        proof: undefined,
+                        awardedDate: '{{completed}}',
+                    }),
+                    `lc:network:network.example/boost:${BOOST_ID}`,
+                    options.domain,
+                    { templateData: { completed } }
+                );
+                expect(credential).not.toHaveProperty('awardedDate');
+            }
+        );
+
+        describe('stampIssuanceDate', () => {
+            const NOW = '2026-10-18T05:00:00.000Z';
+
+            it('sets validFrom and removes issuanceDate on VC 2.0', () => {
+                const stamped = stampIssuanceDate(
+                    {
+                        ...vc,
+                        '@context': V2,
+                        validFrom: MALFORMED_DATE,
+                        issuanceDate: MALFORMED_DATE,
+                    },
+                    NOW
+                );
+
+                expect(stamped.validFrom).toBe(NOW);
+                expect(stamped).not.toHaveProperty('issuanceDate');
+            });
+
+            it('only sets issuanceDate on VC 1.1', () => {
+                const template = { ...vc, '@context': V1, issuanceDate: MALFORMED_DATE };
+
+                expect(stampIssuanceDate({ ...template }, NOW)).toEqual({
+                    ...template,
+                    issuanceDate: NOW,
+                });
+            });
+        });
+    });
+
     it('preserves explicit notification and acceptance opt-outs', async () => {
         await sendBoost({
             ...options,

package/src/helpers/boost.helpers.ts

@@ -1,5 +1,10 @@
 import cloneDeep from 'lodash/cloneDeep';
-import { isEncrypted, isVC2Format } from '@learncard/helpers';
+import {
+    CredentialFieldError,
+    isEncrypted,
+    isVC2Format,
+    materializeCredentialFields,
+} from '@learncard/helpers';
 import { TRPCError } from '@trpc/server';
 import {
     VC,
@@ -87,6 +92,29 @@ export const isBoostViewableByClaimLink = async (boost: BoostInstance): Promise<
     return true;
 };
 
+/**
+ * Stamps the issuance time onto a credential built from a Boost template.
+ *
+ * A template's own issuanceDate/validFrom is when the template was written, not when this
+ * credential is issued, and templates created through the API are not date-validated: a
+ * malformed value (e.g. "2025-10-19+053008:18:16") makes DIDKit refuse to sign. VC 2.0
+ * templates get validFrom and lose any leftover issuanceDate, which the VC 2.0 context doesn't
+ * define (DIDKit rejects it as an undefined JSON-LD term). VC 1.1 templates get issuanceDate.
+ */
+export const stampIssuanceDate = <T extends UnsignedVC | VC>(
+    credential: T,
+    now: string = new Date().toISOString()
+): T => {
+    if (isVC2Format(credential)) {
+        credential.validFrom = now;
+        delete credential.issuanceDate;
+    } else {
+        credential.issuanceDate = now;
+    }
+
+    return credential;
+};
+
 export const convertCredentialToBoostTemplateJSON = (
     credential: VC | UnsignedVC,
     defaultIssuerDid?: string
@@ -255,6 +283,8 @@ export const issueClaimLinkBoost = async (
 
     boostCredential.issuer = signingAuthorityForUser.relationship.did;
 
+    stampIssuanceDate(boostCredential);
+
     setCredentialSubjectIds(boostCredential, getDidWeb(domain, to.profileId));
 
     // Embed the boostURI into the boost credential for verification purposes.
@@ -331,17 +361,20 @@ export const prepareCredentialFromBoost = async (
         boostJsonString = renderBoostTemplate(boostJsonString, mergedTemplateData);
     }
 
-    const credential = parseRenderedTemplate<UnsignedVC>(boostJsonString);
+    let credential: UnsignedVC;
+    try {
+        credential = materializeCredentialFields(
+            parseRenderedTemplate<UnsignedVC>(boostJsonString)
+        ) as UnsignedVC;
+    } catch (error) {
+        if (error instanceof CredentialFieldError)
+            throw new TRPCError({ code: 'BAD_REQUEST', message: error.message, cause: error });
+        throw error;
+    }
 
     appendTemplateEvidenceToCredential(credential, mergedTemplateData, allowAutoAppendEvidence);
 
-    // Set issuance date based on VC version
-    const now = new Date().toISOString();
-    if (isVC2Format(credential)) {
-        credential.validFrom = now;
-    } else {
-        credential.issuanceDate = now;
-    }
+    stampIssuanceDate(credential);
 
     // Set issuer if provided
     if (issuerDid) {
@@ -432,7 +465,16 @@ export const appendTemplateEvidenceToCredential = (
     // EvidenceFile subterms — otherwise the signer fails later with an opaque
     // JSON-LD key-expansion error. Surface a clear message instead so the
     // caller can prompt the user to republish the boost.
-    if (!credentialContextSupportsDynamicEvidence(credential)) {
+    const usesEvidenceExtensions = normalizedTemplateEvidence.some(item => {
+        if (!item || typeof item !== 'object') return false;
+        const evidence = item as Record<string, unknown>;
+        const types = Array.isArray(evidence.type) ? evidence.type : [evidence.type];
+        return (
+            types.includes('EvidenceFile') ||
+            ['fileName', 'fileType', 'fileSize'].some(key => key in evidence)
+        );
+    });
+    if (usesEvidenceExtensions && !credentialContextSupportsDynamicEvidence(credential)) {
         throw new TRPCError({
             code: 'PRECONDITION_FAILED',
             message: