@learncard/network-brain-service 4.1.0 → 4.1.1

package/dist/routes/app-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-store.d.ts","sourceRoot":"","sources":["../../src/routes/app-store.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA2qB5C,eAAO,MAAM,yBAAyB,GAClC,KAAK;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EACvB,SAAS;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC9B,WAAW,MAAM,EACjB,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,cAAc,WAAW,KAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmTjC,CAAC;AA6qCF,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0yDzB,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC"}
+{"version":3,"file":"app-store.d.ts","sourceRoot":"","sources":["../../src/routes/app-store.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA4qB5C,eAAO,MAAM,yBAAyB,GAClC,KAAK;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EACvB,SAAS;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC9B,WAAW,MAAM,EACjB,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,cAAc,WAAW,KAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA4SjC,CAAC;AA6qCF,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0yDzB,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC"}

package/package.json

@@ -1,11 +1,11 @@
 {
     "name": "@learncard/network-brain-service",
-    "version": "4.1.0",
+    "version": "4.1.1",
     "description": "",
     "engines": {
         "node": ">=24.12 <25"
     },
-    "packageManager": "bun@1.4.2",
+    "packageManager": "bun@1.4.4",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",
     "scripts": {
@@ -73,8 +73,8 @@
         "@learncard/crypto-plugin": "1.1.41",
         "@learncard/did-web-plugin": "1.1.41",
         "@learncard/didkey-plugin": "1.1.41",
-        "@learncard/didkit-plugin": "1.10.6",
-        "@learncard/didkit-plugin-node": "0.3.6",
+        "@learncard/didkit-plugin": "1.10.7",
+        "@learncard/didkit-plugin-node": "0.3.7",
         "@learncard/dynamic-loader-plugin": "1.1.41",
         "@learncard/encryption-plugin": "1.1.41",
         "@learncard/expiration-plugin": "1.2.41",

package/project.json

@@ -80,7 +80,7 @@
         },
         "test": {
             "executor": "nx:run-script",
-            "inputs": ["source", "tests"],
+            "inputs": ["source", "tests", "ciTestConfig"],
             "options": {
                 "script": "test"
             }

package/src/helpers/activity.helpers.ts

@@ -32,9 +32,9 @@ export const logCredentialSent = async (params: {
     listingId?: string;
     source: CredentialActivitySourceType;
     metadata?: Record<string, unknown>;
-    // LC-1644 Phase 1d: callers can pre-generate activityId upfront so
-    // logCredentialSent can run in parallel with dependent writes (e.g. sendBoost
-    // which stores activityId on the SentCredential relationship).
+    // Callers can supply a correlation ID for related graph writes. Finish
+    // activity writes before delivery writes touch the same profile/listing;
+    // sharing an ID does not make parallel auto-commit transactions independent.
     activityId?: string;
 }): Promise<string> => {
     const isInboxSend = params.recipientType === 'email' || params.recipientType === 'phone';

package/src/helpers/app-credential-delivery.helpers.test.ts

@@ -0,0 +1,56 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({ activity: vi.fn(), send: vi.fn() }));
+vi.mock('./activity.helpers', () => ({ logCredentialSent: mocks.activity }));
+vi.mock('./boost.helpers', () => ({ sendBoost: mocks.send }));
+
+import { sendAppCredentialWithActivity } from './app-credential-delivery.helpers';
+
+const activity: Parameters<typeof sendAppCredentialWithActivity>[0] = {
+    actorProfileId: 'owner',
+    recipientType: 'profile',
+    recipientIdentifier: 'learner',
+    listingId: 'app',
+    source: 'appEvent',
+};
+const delivery = { listingId: 'app' } as Parameters<typeof sendAppCredentialWithActivity>[1];
+
+describe('app credential delivery graph ordering', () => {
+    beforeEach(() => {
+        vi.resetAllMocks();
+        mocks.send.mockResolvedValue('credential:1');
+    });
+
+    it('waits for the activity write to commit and uses its ID before starting delivery', async () => {
+        let resolve!: (activityId: string) => void;
+        const promise = new Promise<string>(complete => {
+            resolve = complete;
+        });
+        mocks.activity.mockReturnValue(promise);
+        const result = sendAppCredentialWithActivity(activity, delivery);
+        expect(mocks.activity).toHaveBeenCalledExactlyOnceWith(activity);
+        expect(mocks.send).not.toHaveBeenCalled();
+        resolve('activity:1');
+        expect(await result).toBe('credential:1');
+        expect(mocks.send).toHaveBeenCalledExactlyOnceWith({
+            ...delivery,
+            activityId: 'activity:1',
+        });
+    });
+
+    it('does not deliver a credential after an activity write fails', async () => {
+        const error = new Error('activity write failed');
+        mocks.activity.mockRejectedValue(error);
+        await expect(sendAppCredentialWithActivity(activity, delivery)).rejects.toBe(error);
+        expect(mocks.send).not.toHaveBeenCalled();
+    });
+
+    it('propagates delivery failure without retrying activity or delivery', async () => {
+        const error = new Error('delivery failed');
+        mocks.activity.mockResolvedValue('activity:1');
+        mocks.send.mockRejectedValue(error);
+        await expect(sendAppCredentialWithActivity(activity, delivery)).rejects.toBe(error);
+        expect(mocks.activity).toHaveBeenCalledOnce();
+        expect(mocks.send).toHaveBeenCalledOnce();
+    });
+});

package/src/helpers/app-credential-delivery.helpers.ts

@@ -0,0 +1,11 @@
+import { logCredentialSent } from './activity.helpers';
+import { sendBoost } from './boost.helpers';
+
+/** Complete activity graph writes before delivery writes touch the same listing. */
+export const sendAppCredentialWithActivity = async (
+    activity: Parameters<typeof logCredentialSent>[0],
+    delivery: Omit<Parameters<typeof sendBoost>[0], 'activityId'>
+): Promise<string> => {
+    const activityId = await logCredentialSent(activity);
+    return sendBoost({ ...delivery, activityId });
+};

package/src/helpers/boost-storage.helpers.test.ts

@@ -107,6 +107,14 @@ const options = {
     integrationId: 'integration',
 } as unknown as Parameters<typeof sendBoost>[0];
 
+const deferred = () => {
+    let resolve!: () => void;
+    const promise = new Promise<void>(complete => {
+        resolve = complete;
+    });
+    return { promise, resolve };
+};
+
 describe('boost payload storage', () => {
     beforeEach(() => {
         vi.clearAllMocks();
@@ -167,6 +175,61 @@ describe('boost payload storage', () => {
         }
     );
 
+    it('does not overlap relationship writes that touch the same credential', async () => {
+        const first = deferred();
+        const sent = deferred();
+        const listing = deferred();
+        const contract = deferred();
+        mocks.instanceOf.mockReturnValueOnce(first.promise);
+        mocks.sent.mockReturnValueOnce(sent.promise);
+        mocks.listing.mockReturnValueOnce(listing.promise);
+        mocks.contract.mockReturnValueOnce(contract.promise);
+        const result = sendBoost(options);
+        await vi.waitFor(() => expect(mocks.instanceOf).toHaveBeenCalledOnce());
+        expect(mocks.sent).not.toHaveBeenCalled();
+        first.resolve();
+        await vi.waitFor(() => expect(mocks.sent).toHaveBeenCalledOnce());
+        expect(mocks.listing).not.toHaveBeenCalled();
+        sent.resolve();
+        await vi.waitFor(() => expect(mocks.listing).toHaveBeenCalledOnce());
+        expect(mocks.contract).not.toHaveBeenCalled();
+        listing.resolve();
+        await vi.waitFor(() => expect(mocks.contract).toHaveBeenCalledOnce());
+        expect(mocks.accept).not.toHaveBeenCalled();
+        expect(mocks.notify).not.toHaveBeenCalled();
+        contract.resolve();
+        await expect(result).resolves.toBe('lc:network:network.example/credential:stored');
+    });
+
+    it.each(['instanceOf', 'sent', 'listing', 'contract'] as const)(
+        'stops after a failed %s relationship without acceptance or notification',
+        async failed => {
+            const error = new Error('graph write failed');
+            mocks[failed].mockRejectedValueOnce(error);
+            await expect(sendBoost(options)).rejects.toBe(error);
+            const order = ['instanceOf', 'sent', 'listing', 'contract'] as const;
+            for (const later of order.slice(order.indexOf(failed) + 1)) {
+                expect(mocks[later]).not.toHaveBeenCalled();
+            }
+            expect(mocks.accept).not.toHaveBeenCalled();
+            expect(mocks.notify).not.toHaveBeenCalled();
+        }
+    );
+
+    it.each(['listing', 'another-listing', undefined])(
+        'adds explicit listing attribution only when the listing issuer does not already cover %s',
+        async listingId => {
+            const from = {
+                type: 'appStoreListing',
+                listing: { listing_id: 'listing' },
+                ownerProfile: { profileId: 'org' },
+            } as Parameters<typeof sendBoost>[0]['from'];
+            await sendBoost({ ...options, from, listingId });
+            expect(mocks.sent).toHaveBeenCalledOnce();
+            expect(mocks.listing).toHaveBeenCalledTimes(listingId === 'another-listing' ? 1 : 0);
+        }
+    );
+
     it('does not inspect template-derived fields or add a network signature', async () => {
         const credential = { ...vc, display: { backgroundColor: '#bad' } };
         await sendBoost({ ...options, credential });

package/src/helpers/boost.helpers.ts

@@ -19,6 +19,7 @@ import {
     getIssuerDisplayName,
     getIssuerOwnerProfile,
     getIssuerProfileId,
+    isAppStoreListingIssuer,
 } from '../types/issuer';
 import { trace, traceDb } from '@tracing';
 import { injectObv3AlignmentsIntoCredentialForBoost } from '@services/skills-provider/inject';
@@ -182,38 +183,42 @@ export const sendBoost = async ({
                 storeCredential(credential)
             );
 
-            const tasks = [
-                createBoostInstanceOfRelationship(credentialInstance, boost),
-                createSentCredentialRelationship(
+            // These writes share Credential/Profile/Listing nodes. Separate concurrent
+            // auto-commit transactions can deadlock on Neo4j relationship-chain locks.
+            await traceDb('createRelationships', async () => {
+                await createBoostInstanceOfRelationship(credentialInstance, boost);
+                await createSentCredentialRelationship(
                     from,
                     to,
                     credentialInstance,
                     metadata,
                     activityId,
                     integrationId
-                ),
-            ];
+                );
 
-            if (listingId) {
-                tasks.push(
-                    createListingSentCredentialRelationship(
+                // Listing issuers already create this edge inside createSentCredentialRelationship.
+                // Keep explicit attribution for profile/integration issuers or another listing.
+                if (
+                    listingId &&
+                    (!isAppStoreListingIssuer(from) || from.listing.listing_id !== listingId)
+                ) {
+                    await createListingSentCredentialRelationship(
                         listingId,
                         to,
                         credentialInstance,
                         metadata,
                         activityId,
                         integrationId
-                    )
-                );
-            }
-
-            if (contractTerms) {
-                tasks.push(
-                    createCredentialIssuedViaContractRelationship(credentialInstance, contractTerms)
-                );
-            }
+                    );
+                }
 
-            await traceDb('createRelationships', () => Promise.all(tasks));
+                if (contractTerms) {
+                    await createCredentialIssuedViaContractRelationship(
+                        credentialInstance,
+                        contractTerms
+                    );
+                }
+            });
 
             if (autoAcceptCredential) {
                 await acceptCredential(to, getCredentialUri(credentialInstance.id, domain), {

package/src/helpers/sentry.helpers.test.ts

@@ -0,0 +1,56 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { TRPCError } from '@trpc/server';
+
+const sentry = vi.hoisted(() => ({
+    captureException: vi.fn(),
+    setHttpStatus: vi.fn(),
+}));
+
+vi.mock('@sentry/serverless', () => ({
+    captureException: sentry.captureException,
+    getActiveTransaction: () => ({ setHttpStatus: sentry.setHttpStatus }),
+}));
+vi.mock('@environment', () => ({ environment: { SENTRY_ENV: 'test' } }));
+
+import { handleTrpcError, sentryBeforeSend, shouldReportError } from './sentry.helpers';
+
+const event: Parameters<typeof sentryBeforeSend>[0] = { event_id: 'event', type: undefined };
+
+describe('sentry helpers', () => {
+    beforeEach(() => {
+        sentry.captureException.mockClear();
+        sentry.setHttpStatus.mockClear();
+    });
+
+    it('does not capture a repeated contract consent conflict', () => {
+        const error = new TRPCError({
+            code: 'CONFLICT',
+            message: "You've already consented to this contract!",
+        });
+
+        handleTrpcError({ error, ctx: {}, path: 'contracts.consentToContract' });
+
+        expect(sentry.captureException).not.toHaveBeenCalled();
+        expect(sentry.setHttpStatus).toHaveBeenCalledWith(409);
+        expect(sentryBeforeSend(event, { originalException: error })).toBeNull();
+    });
+
+    it.each(['BAD_REQUEST', 'NOT_FOUND', 'FORBIDDEN', 'CONFLICT'])(
+        'treats %s as an expected client error',
+        code => {
+            expect(shouldReportError(code)).toBe(false);
+        }
+    );
+
+    it('still captures unexpected server errors', () => {
+        const error = new TRPCError({ code: 'INTERNAL_SERVER_ERROR', message: 'boom' });
+
+        handleTrpcError({ error, ctx: {}, path: 'contracts.consentToContract' });
+
+        expect(sentry.captureException).toHaveBeenCalledWith(
+            error,
+            expect.objectContaining({ level: 'error' })
+        );
+        expect(sentryBeforeSend(event, { originalException: error })).toBe(event);
+    });
+});

package/src/helpers/sentry.helpers.ts

@@ -5,9 +5,10 @@ import type { TRPCError } from '@trpc/server';
 
 /**
  * Error codes that are expected/non-critical and should not be sent to Sentry.
- * These typically represent user errors or expected authentication failures.
+ * These typically represent user errors, expected authentication failures, or
+ * client-visible state conflicts such as re-consenting to the same contract.
  */
-const IGNORED_ERROR_CODES = ['BAD_REQUEST', 'NOT_FOUND', 'FORBIDDEN'];
+const IGNORED_ERROR_CODES = ['BAD_REQUEST', 'NOT_FOUND', 'FORBIDDEN', 'CONFLICT'];
 
 /**
  * Determines if an error should be reported to Sentry based on its code.
@@ -38,7 +39,7 @@ export const handleTrpcError = ({
         !(ctx as { user?: { isChallengeValid?: boolean } })?.user?.isChallengeValid;
 
     // Only capture unexpected/critical errors
-    // Filter out expected errors (BAD_REQUEST, NOT_FOUND, FORBIDDEN) and invalid challenge attempts
+    // Filter out expected errors (see IGNORED_ERROR_CODES) and invalid challenge attempts
     if (shouldReportError(error.code) && !isInvalidChallenge) {
         Sentry.captureException(error, {
             extra: { ctx, path },

package/src/routes/app-store.ts

@@ -1,5 +1,4 @@
 import { TRPCError } from '@trpc/server';
-import { v4 as uuid } from 'uuid';
 import { z } from 'zod';
 import {
     PendingListingUpdateValidator,
@@ -48,6 +47,7 @@ import {
     invalidateConsentContractForListingByScopeHashCache,
 } from '@cache/app-store.caches';
 import { logCredentialSent } from '@helpers/activity.helpers';
+import { sendAppCredentialWithActivity } from '@helpers/app-credential-delivery.helpers';
 import { getCredentialUri } from '@helpers/credential.helpers';
 import { constructUri, resolveUri } from '@helpers/uri.helpers';
 import { inflateObject } from '@helpers/objects.helpers';
@@ -947,15 +947,10 @@ export const handleSendCredentialEvent = async (
 
     perf.mark('saIssue');
 
-    // LC-1644 Phase 1d: run logCredentialSent + sendBoost in parallel. They previously
-    // ran serially because sendBoost needed activityId as a foreign key on the
-    // SentCredential relationship. We now pre-generate the activityId upfront (matching
-    // the uuid the activity log would have chosen itself) and pass it to both calls.
-    // Both writes produce the same Neo4j linkage as before; we just fan them out.
-    // At staging this saves ~40ms on the serial sum (logActivity 40ms + sendBoost 50ms).
-    const activityId = uuid();
-    const [, credentialUri] = await Promise.all([
-        logCredentialSent({
+    // Activity and delivery both write listing relationships; finish one before
+    // starting the other so one request cannot deadlock against its own writes.
+    const credentialUri = await sendAppCredentialWithActivity(
+        {
             actorProfileId: integrationOwner.profileId,
             recipientType: 'profile',
             recipientIdentifier: target.profileId,
@@ -965,20 +960,18 @@ export const handleSendCredentialEvent = async (
             listingId,
             source: 'appEvent',
             metadata: { listingId, templateAlias },
-            activityId,
-        }),
-        sendBoost({
+        },
+        {
             from: issuer,
             to: target,
             boost,
             credential,
             domain: ctx.domain,
             skipNotification: false,
-            activityId,
             integrationId: integration.id,
             listingId,
-        }),
-    ]);
+        }
+    );
 
     perf.mark('logActivityAndSendBoost');
 

package/test/app-credential-delivery.neo4j.spec.ts

@@ -0,0 +1,110 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { neogma } from '@instance';
+import { Boost } from '@models';
+import { sendAppCredentialWithActivity } from '@helpers/app-credential-delivery.helpers';
+import { getBoostUri } from '@helpers/boost.helpers';
+import type { CredentialIssuer } from '../src/types/issuer';
+
+const domain = 'localhost%3A3000';
+const issuer: CredentialIssuer = {
+    type: 'appStoreListing',
+    listing: { listing_id: 'race-listing', display_name: 'Race Test App' },
+    ownerProfile: { profileId: 'race-owner' },
+} as CredentialIssuer;
+const credential = {
+    protected: 'header',
+    iv: 'iv',
+    ciphertext: 'ciphertext',
+    tag: 'tag',
+    recipients: [],
+};
+
+// The integration and CI inbox configs both supply a fresh Testcontainers database.
+// No environment-configured development or deployed database is used.
+describe('app credential delivery graph (real Neo4j)', () => {
+    beforeEach(async () => {
+        await neogma.queryRunner.run('MATCH (n) DETACH DELETE n');
+        await neogma.queryRunner.run(`
+            CREATE (owner:Profile {profileId: 'race-owner'}),
+                   (learner:Profile {profileId: 'race-learner'}),
+                   (listing:AppStoreListing {listing_id: 'race-listing'}),
+                   (boost:Boost {id: 'race-boost'})
+            CREATE (owner)-[:PUBLISHED]->(listing), (listing)-[:HAS_BOOST]->(boost)
+        `);
+    });
+
+    const issue = async (sequence: number): Promise<string> => {
+        const boost = await Boost.findOne({ where: { id: 'race-boost' } });
+        if (!boost) throw new Error('Missing fixture boost');
+        return sendAppCredentialWithActivity(
+            {
+                actorProfileId: 'race-owner',
+                recipientType: 'profile',
+                recipientIdentifier: 'race-learner',
+                recipientProfileId: 'race-learner',
+                boostUri: getBoostUri(boost.id, domain),
+                integrationId: 'race-integration',
+                listingId: 'race-listing',
+                source: 'appEvent',
+                metadata: { sequence },
+            },
+            {
+                from: issuer,
+                to: { profileId: 'race-learner' },
+                boost,
+                credential,
+                domain,
+                skipNotification: true,
+                listingId: 'race-listing',
+                integrationId: 'race-integration',
+                metadata: { sequence },
+            }
+        );
+    };
+
+    const assertGraph = async (expected: number): Promise<void> => {
+        const { records } = await neogma.queryRunner.run(`
+            MATCH (c:Credential)
+            RETURN c.credential AS payload,
+                [(p:Profile)-[r:CREDENTIAL_SENT]->(c) | properties(r)] AS profileEdges,
+                [(l:AppStoreListing)-[r:CREDENTIAL_SENT]->(c) | properties(r)] AS listingEdges,
+                [(c)-[:INSTANCE_OF]->(b:Boost) | b.id] AS boosts
+        `);
+        expect(records).toHaveLength(expected);
+        for (const row of records) {
+            expect(JSON.parse(row.get('payload'))).toEqual(credential);
+            expect(row.get('profileEdges')).toHaveLength(1);
+            expect(row.get('listingEdges')).toHaveLength(1);
+            expect(row.get('boosts')).toEqual(['race-boost']);
+            const [edge] = row.get('listingEdges');
+            expect(edge.to).toBe('race-learner');
+            expect(edge.integrationId).toBe('race-integration');
+            expect(edge.activityId).toBe(row.get('profileEdges')[0].activityId);
+            const result = await neogma.queryRunner.run(
+                `
+                MATCH (:AppStoreListing {listing_id: 'race-listing'})-[:PERFORMED_BY_LISTING]->(a:CredentialActivity {activityId: $activityId})
+                MATCH (:Profile {profileId: 'race-owner'})-[:PERFORMED]->(a)
+                MATCH (a)-[:TO_RECIPIENT]->(:Profile {profileId: 'race-learner'})
+                MATCH (a)-[:FOR_BOOST]->(:Boost {id: 'race-boost'})
+                RETURN a.metadata AS metadata
+            `,
+                { activityId: edge.activityId }
+            );
+            expect(result.records).toHaveLength(1);
+            expect(JSON.parse(result.records[0].get('metadata')).sequence).toBe(
+                Number(edge['metadata.sequence'])
+            );
+        }
+    };
+
+    it('repeated sends create exactly one linked activity and each required delivery edge', async () => {
+        for (let i = 0; i < 30; i++) await issue(i);
+        await assertGraph(30);
+    });
+
+    it('independent simultaneous sends keep their own activity and attribution', async () => {
+        const uris = await Promise.all(Array.from({ length: 8 }, (_, i) => issue(i)));
+        expect(new Set(uris).size).toBe(8);
+        await assertGraph(8);
+    });
+});

package/tsconfig.json

@@ -16,20 +16,20 @@
         "emitDeclarationOnly": true,
         "sourceMap": true,
         "rootDir": ".",
-        "baseUrl": ".",
         "paths": {
-            "@accesslayer/*": ["src/accesslayer/*"],
-            "@cache": ["src/cache/index.ts"],
-            "@cache/*": ["src/cache/*"],
-            "@environment": ["src/config/environment.ts"],
-            "@helpers/*": ["src/helpers/*"],
-            "@instance": ["src/instance.ts"],
-            "@models": ["src/models/index.ts"],
-            "@routes": ["src/routes/index.ts"],
-            "@routes/*": ["src/routes/*"],
-            "types/*": ["src/types/*"],
-            "@services/*": ["src/services/*"],
-            "@tracing": ["src/tracing/index.ts"]
+            "src/*": ["./src/*"],
+            "@accesslayer/*": ["./src/accesslayer/*"],
+            "@cache": ["./src/cache/index.ts"],
+            "@cache/*": ["./src/cache/*"],
+            "@environment": ["./src/config/environment.ts"],
+            "@helpers/*": ["./src/helpers/*"],
+            "@instance": ["./src/instance.ts"],
+            "@models": ["./src/models/index.ts"],
+            "@routes": ["./src/routes/index.ts"],
+            "@routes/*": ["./src/routes/*"],
+            "types/*": ["./src/types/*"],
+            "@services/*": ["./src/services/*"],
+            "@tracing": ["./src/tracing/index.ts"]
         },
         "esModuleInterop": true,
         "allowSyntheticDefaultImports": true,

package/vitest.config.ts

@@ -25,6 +25,7 @@ export default createVitestConfig(brainServicePreset, {
             'test/openapi.spec.ts',
             'src/helpers/posthog.helpers.test.ts',
             'src/helpers/rateLimit.helpers.test.ts',
+            'src/helpers/sentry.helpers.test.ts',
             'src/helpers/credentialSubject.helpers.test.ts',
             'src/helpers/inbox-batch.helpers.test.ts',
             'src/helpers/inbox-queue.helpers.test.ts',
@@ -51,6 +52,7 @@ export default createVitestConfig(brainServicePreset, {
             'src/helpers/signingAuthority.helpers.test.ts',
             'src/helpers/status-list.helpers.test.ts',
             'src/helpers/boost-storage.helpers.test.ts',
+            'src/helpers/app-credential-delivery.helpers.test.ts',
             'src/accesslayer/credential/create.test.ts',
             'src/accesslayer/inbox-batch/schema.test.ts',
             'src/helpers/inbox-encryption.helpers.test.ts',

package/vitest.inbox-e2e.config.ts

@@ -13,6 +13,7 @@ export default createVitestConfig(serviceIntegrationPreset, {
             'test/inbox-batch.spec.ts',
             'test/atomic-counter.e2e.ts',
             'test/credential-storage.neo4j.spec.ts',
+            'test/app-credential-delivery.neo4j.spec.ts',
             'test/inbox.spec.ts',
         ],
         alias: { '@instance': require.resolve('./test/helpers/mock-instance.ts') },