@learncard/network-brain-service 4.1.2 → 5.0.0

package/.env.example

@@ -16,6 +16,13 @@ NEO4J_PASSWORD=this-is-the-password
 
 # Optional integration credentials; all are bundle/fallback-only in Lambda.
 POSTMARK_API_KEY=
+# Campaign email: deployed values come from LearnCard Runtime /learncard/brain-service/runtime.
+# Stream ID is non-secret; the dedicated signing secret must be stable and at least 32 bytes.
+# Local/Docker reads this .env; runtime bundle changes require recycling Lambda functions.
+POSTMARK_BROADCAST_STREAM=broadcast
+CAMPAIGN_UNSUBSCRIBE_SECRET=
+# Deployment-owned browser origins for campaign CTAs. Hosted defaults live in stage config.
+CAMPAIGN_APP_ORIGINS={"learncard":"http://localhost:3000"}
 MESSAGEBIRD_AUTH_TOKEN=
 SENTRY_DSN=
 POSTHOG_API_KEY=
@@ -32,6 +39,13 @@ LOGIN_PROVIDER_DID=
 NOTIFICATIONS_SERVICE_WEBHOOK_URL=
 # Both checked-in stages enable credential refresh. Use independent, stable private secrets.
 CREDENTIAL_REFRESH_DIGEST_SECRET=local-only-replace-before-deploy-refresh-digest-secret
+# Rotate SECRET and KEY_VERSION together; retain the old secret keyed by its old version:
+# CREDENTIAL_REFRESH_DIGEST_PREVIOUS_KEYS='{"v1":"old-secret"}' with KEY_VERSION=v2.
+# Keep previous keys until affected aggregates republish, and longer while original
+# subject/status/root fingerprints still reference them (publication does not rewrite those).
+# Notification route/delivery keys also rotate, which may yield one duplicate notification.
+CREDENTIAL_REFRESH_DIGEST_KEY_VERSION=v1
+CREDENTIAL_REFRESH_DIGEST_PREVIOUS_KEYS={}
 SHARE_LINK_REQUEST_HASH_SECRET=local-only-replace-before-deploy-share-link-request-secret
 
 # Skill embeddings (LC-2206): Amazon Nova 2 Multimodal Embeddings on Bedrock via SigV4 with

package/CHANGELOG.md

@@ -1,5 +1,169 @@
 # @learncard/network-brain-service
 
+## 5.0.0
+
+### Major Changes
+
+- [#1819](https://github.com/learningeconomy/LearnCard/pull/1819) [`784f0c9b346a5f7e4e2c618a9b976dcaa90fafe3`](https://github.com/learningeconomy/LearnCard/commit/784f0c9b346a5f7e4e2c618a9b976dcaa90fafe3) Thanks [@smurflo2](https://github.com/smurflo2)! - feat: [LC-2194] Support versioned ConsentFlow updates and user review.
+
+    Keep a connection's URI and history while publishing immutable access updates. New optional read/write choices stay off; required additions pause writes until the user reviews the changes. Add explicit update acceptance, review notifications, deadlines, once-only AutoBoost delivery, and safe retirement. Unsaved request previews no longer require a URI.
+
+    Preserve existing grants in partial scope updates, gate Lambda startup on legacy snapshots, and retain once-only delivery during explicit one-time updates. Localize review and history content, recover from cancelled guardian checks and concurrent updates, and keep handled notifications safe to reopen.
+
+    Retry transient Lambda migration failures without poisoning warm application imports. Record completed migrations for fast cold starts, report malformed request IDs without credential data, and identify retained ambiguous AutoBoost claims for reconciliation. Load runtime secrets before importing the scheduled deadline worker, including secrets-only Lambda deployments. Keep inbox maintenance coverage behavioral rather than pinning Lambda wrapper source text.
+
+    Recover valid, unversioned contracts created after the migration marker through scoped version-1 initialization. Atomically backfill only their existing connections, preserve global migration completion, and keep missing history on already-versioned or malformed contracts fail-closed.
+
+    Settle guardian PIN actions on external dismissal or unmount without cancelling valid submissions. Cover reapproval, signing failures and referral cancellation with the current PIN modal contract. Clear stacked overlays before opening a contract-update review. Cancel delayed modal-removal timers when their provider unmounts while preserving closing animations. Use stable localization keys independent of English labels and stop proposing optional defaults after their window expires.
+
+    Route pending and suspended connections from ordinary consent entry to explicit update review. Recover the same way when the latest-approval error arrives during an open consent dialog, without treating the connection as approved or bypassing guardian checks.
+
+    Reject overlapping top-level and nested SDK scope patches instead of silently dropping changes. Restore strict type-only imports, declare the runnable update snippet's SDK contract, and narrow unsuccessful notification reads in end-to-end consumers without raising the typecheck allowance.
+
+    Include cumulative changes in consent records so users can approve all required additions across multiple unreviewed versions. Clear the pending optional-choice marker only when the holder successfully saves their choices.
+
+    Resolve built-in request categories and personal fields to localized labels and descriptions in English, Spanish, French, and Arabic, including learning history and career/AI categories. Recognize the legitimate French cognates “Image” and “Qualifications” in the existing untranslated-value guard.
+
+    Dismiss Alerts when opening a contract-update review without waiting for read-status writes. Give unread indicators their own layout space so they cannot overlap notification dates.
+
+    Use one shared request form with the original creation controls for creating and editing requests, without per-item purpose fields or added default-enabled checkboxes. Keep the overall update explanation separate. Replace JSON authoring with readable changes and Preview Update / Publish Update actions in the Contracts tab. Show an accessible help icon and meaningful existing-access/defaults disclosures.
+
+    Start new optional review controls from their Opt-in/Opt-out settings without silently granting access. Use the edited request's defaults in previews, refresh saved choices when reopening without overwriting active edits, and reduce the extra spacing below the current version.
+
+    Separate Advanced Options from changes, published feedback, and actions. Add space below the current version while keeping the image's remove control in its original outside corner.
+
+    Show a clear unavailable state for networks that omit contract version metadata, including cached responses. Keep publishing disabled until a versioned response is available, and never assume an unversioned response is version 1.
+
+    Use direct Mongo connections for the local Docker APIs so the single-node replica's localhost address does not prevent them from starting. Gate Mongo-dependent services on a writable primary so they do not exit during replica initialization or election.
+
+    Pre-bundle the remaining workspace crypto and cloud-client dependencies before serving the local app, avoiding dependency-discovery reloads during browser startup.
+
+    Open an on-demand Update contract modal from each configured request in the Contracts tab, rather than the Testing tab. Reveal the update explanation only after edits, separate it from grouped current/next values, and keep user-review previews in the shared modal stack for correct focus and Escape behavior.
+
+    Breaking SDK/API changes: use `updateContract` instead of the removed `addAutoBoostsToContract` and `removeAutoBoostsFromContract` SDK methods. One-time consent status is now `consumed`, not `stale`. The deprecated HTTP AutoBoost routes remain available for one compatibility release and use the versioned update path. Legacy AutoBoost additions also pause writes and synchronization pending explicit holder review; coordinate partner upgrades and support `getConsentStatus` / `reviewUrl` before rollout.
+
+    Reject stale editor drafts with their original expected version, treat equivalent updates as no-ops, require future reconsent deadlines, and restrict legacy AutoBoost publications to contract owners. Paginate tied consent-data timestamps with stable opaque cursors and preserve all unreviewed optional additions across later updates.
+
+    Track each holder's last explicit review, backfill that baseline from transaction history, and timestamp legacy snapshots at the revision actually captured. Require notification and approval when an existing item's reason changes; keep redirect-only changes quiet. Retain ambiguous initial AutoBoost claims and reject mismatched concurrent initial credential deliveries.
+
+    Show material metadata, writer, and automatic-delivery changes alongside scope updates. Refresh holder terms before enabling review edits, populate newly enabled personal fields from the holder profile, and use a structured approval-required reason instead of matching error text.
+
+    Regenerate the Python API client from the current router graph, including all consent lifecycle states, versioned updates, and review metadata. Omit `None` for ordinary non-nullable optional inputs, preserve nullable values, and retain the allocation holder's explicit-null rejection instead of silently treating it as an omission.
+
+    Preserve existing delegated AutoBoost issuers when owners publish unchanged configurations, while keeping new configurations owner-issued and rejecting changes to an existing delegated signer. Defer new cross-account setup until an explicit issuer-authorization flow is available. Use pre-upgrade persisted fixtures for legacy-delegation regressions without reopening writer publication, and fix the signer mock's recursive self-call in consent regressions.
+
+    Keep saves from already handled reviews in ordinary sharing-update history, and preserve the saved one-time setting when update or reconsent inputs omit it.
+
+    Use opaque timestamp-and-ID cursors for holder consent lists, between-profile data, transaction history, and holder exports as well as owner data pages. Preserve legacy timestamp fallbacks and reject malformed or pre-upgrade date-only cursors with `BAD_REQUEST`; restart pagination without a cursor after upgrading.
+
+    Pin owned verification review links to the allocated app origin so real consent review URLs never escape to an unrelated localhost development server.
+
+    Explain approval notifications above Publish Update without changing checked-by-default Opt-out selections. Synchronize the CLI method catalog with the versioned contract SDK, removing obsolete AutoBoost commands and exposing update, history, status, and acceptance methods.
+
+    Use neutral changed-request summaries and Updated badges for existing-scope edits, including reason-only reviews. Reserve new-access headlines and new-item counts for pure scope additions without material request-detail edits, and retain existing optional choices during approval.
+
+### Minor Changes
+
+- [#1904](https://github.com/learningeconomy/LearnCard/pull/1904) [`69b80366c48e0f458b3bb50f25166c90ecaa2d6d`](https://github.com/learningeconomy/LearnCard/commit/69b80366c48e0f458b3bb50f25166c90ecaa2d6d) Thanks [@gerardopar](https://github.com/gerardopar)! - Add branded campaign broadcast emails, duplicate-safe reservations, signed public unsubscribe, and private announcement email/push preferences.
+
+- [#1839](https://github.com/learningeconomy/LearnCard/pull/1839) [`0caa0e478bce246793893e488f37ee90c9b00a1a`](https://github.com/learningeconomy/LearnCard/commit/0caa0e478bce246793893e488f37ee90c9b00a1a) Thanks [@gerardopar](https://github.com/gerardopar)! - Add campaign test-to-me and paced audience notification dispatch, ANNOUNCEMENT metadata, delivery acknowledgement bookkeeping, and retry-safe inbox deduplication.
+
+    Deploy lca-api's enum and campaign deduplication support before enabling brain-service dispatch. Push retains the existing best-effort delivery behavior.
+
+- [#1962](https://github.com/learningeconomy/LearnCard/pull/1962) [`2c60b1a760958cbfe2525bc951d2381332e1aa48`](https://github.com/learningeconomy/LearnCard/commit/2c60b1a760958cbfe2525bc951d2381332e1aa48) Thanks [@Custard7](https://github.com/Custard7)! - Add holder-authorized pre-accept managed delivery receipts and shared binding validation.
+  Allow refresh callers to pin the original public status and refresh service, and reject
+  changed managed versions without a strictly newer signed validFrom. Verify managed
+  deliveries before claim previews, acceptance and local indexing, and retain their
+  validated binding with the local index record.
+
+    Add a strict ciphertext-only holder handoff contract, an explicit-recipient DAG JWE
+    primitive that does not add the caller, and a shared exact recipient-key-set check.
+
+    Enable server-side holder-mode (student-only encrypted) managed sends and publishes.
+    `boost.prepareRefreshableSend({ encryption: 'holder' })` returns the exact
+    key-agreement recipient set (holder + current managers) to encrypt to and pins the
+    refresh aggregate to holder mode. New issuer routes
+    `credentialRefresh.sendHolderEncryptedRefreshable`,
+    `credentialRefresh.publishHolderEncryptedRefreshable` and
+    `credentialRefresh.getEncryptionRecipients` accept and deliver an already-encrypted
+    handoff without ever decrypting it; a manager-set change since prepare fails with
+    `CONFLICT`/`RECIPIENTS_CHANGED` instead of silently narrowing who can decrypt. A
+    holder-mode aggregate rejects inbox recipients, signed-credential-only sends, mixed
+    network/holder sends on the same aggregate, and signing-authority publication.
+
+    SDK support: `send({ refresh: true, encryption: 'holder' })` builds and signs the
+    credential locally exactly as the network-mode path does, then encrypts it to the
+    prepared recipient set with `createDagJweExact`, checks the resulting JWE's recipient
+    set and the signed credential's binding before ever calling the network, and sends
+    only the ciphertext handoff via `credentialRefresh.sendHolderEncryptedRefreshable`. A
+    `RECIPIENTS_CHANGED` conflict is retried once after re-fetching
+    `credentialRefresh.getEncryptionRecipients`. The new `publishHolderEncryptedRefreshable`
+    method does the same for later versions with an explicit `notify` flag. Both reject
+    client-side for inbox recipients, a caller-supplied `signedCredential`, and wallets
+    without local signing or the Encryption plugin; an old server response missing
+    `recipientKeyIds` is rejected rather than silently sent in network mode.
+
+    Recover authenticated absent-status bindings lazily for legacy deliveries, using the
+    stored JSON string `null` to distinguish verified absence from a missing binding.
+    Allow explicit null status repair only when it matches the original status digest.
+    Legacy receipts without a stored refresh descriptor explicitly bind only the unique
+    allocated managed entry; exact receipts continue to bind the entire signed shape.
+    Holder publishing preserves a supplied original refresh descriptor in legacy mode,
+    and fails with repair/reissue guidance when that descriptor is unavailable.
+    Holder sends also preserve template-supplied external status entries instead of
+    forcing new server status allocation.
+
+### Patch Changes
+
+- [#1872](https://github.com/learningeconomy/LearnCard/pull/1872) [`3505f004376543ff4c723921868e17c400142884`](https://github.com/learningeconomy/LearnCard/commit/3505f004376543ff4c723921868e17c400142884) Thanks [@TaylorBeeston](https://github.com/TaylorBeeston)! - Install python3, make, and g++ during `bun install` in the shared monorepo Docker image so linux/arm64 builds can compile native addons (utf-8-validate) via node-gyp.
+
+- [#1959](https://github.com/learningeconomy/LearnCard/pull/1959) [`bde3fe0f15a780d9fafc699096a9a0307502f529`](https://github.com/learningeconomy/LearnCard/commit/bde3fe0f15a780d9fafc699096a9a0307502f529) Thanks [@Custard7](https://github.com/Custard7)! - Use server-bound public status coordinates for managed credential sends, preserving status descriptors across credential versions. Add the managed status repair contract.
+
+    Support external HTTPS Bitstring Status Lists for managed issuance, publication and repair without reserving external indexes. Preserve template-provided status descriptors and report statusManagement separately from the signed refresh receipt. Managed lifecycle actions on external entries fail with a provider-specific precondition error rather than reporting a network-only revocation or suspension.
+
+    Gate preparation-time status binding on client capability so existing clients can continue allocating status coordinates before signing. Preserve the selected mode across idempotent retries.
+
+- [#1960](https://github.com/learningeconomy/LearnCard/pull/1960) [`751579d9c14116dbf6d0e7f7d62f489c81c39db2`](https://github.com/learningeconomy/LearnCard/commit/751579d9c14116dbf6d0e7f7d62f489c81c39db2) Thanks [@Custard7](https://github.com/Custard7)! - Keep managed and signed-only send anchors limited to explicit public display metadata, disable request-input telemetry on credential routes, and remove signing-key debug output. Add bounded public update summaries and enumerated update reasons. Managed send request fingerprints now use a versioned server HMAC over public metadata only. The inline template's name is never copied to the anchor, but its category is copied when `display.category` is omitted, since consent-flow write authorization is keyed on a Boost's category and treats an absent one as unrestricted.
+
+- Updated dependencies [[`e9d738eea3b477dbd82bde171d3c5f8ffa2efbc5`](https://github.com/learningeconomy/LearnCard/commit/e9d738eea3b477dbd82bde171d3c5f8ffa2efbc5), [`69b80366c48e0f458b3bb50f25166c90ecaa2d6d`](https://github.com/learningeconomy/LearnCard/commit/69b80366c48e0f458b3bb50f25166c90ecaa2d6d), [`69b80366c48e0f458b3bb50f25166c90ecaa2d6d`](https://github.com/learningeconomy/LearnCard/commit/69b80366c48e0f458b3bb50f25166c90ecaa2d6d), [`0caa0e478bce246793893e488f37ee90c9b00a1a`](https://github.com/learningeconomy/LearnCard/commit/0caa0e478bce246793893e488f37ee90c9b00a1a), [`fea9c25ec76f230944a1713500a280c80e2a9cc0`](https://github.com/learningeconomy/LearnCard/commit/fea9c25ec76f230944a1713500a280c80e2a9cc0), [`bde3fe0f15a780d9fafc699096a9a0307502f529`](https://github.com/learningeconomy/LearnCard/commit/bde3fe0f15a780d9fafc699096a9a0307502f529), [`784f0c9b346a5f7e4e2c618a9b976dcaa90fafe3`](https://github.com/learningeconomy/LearnCard/commit/784f0c9b346a5f7e4e2c618a9b976dcaa90fafe3), [`751579d9c14116dbf6d0e7f7d62f489c81c39db2`](https://github.com/learningeconomy/LearnCard/commit/751579d9c14116dbf6d0e7f7d62f489c81c39db2), [`2c60b1a760958cbfe2525bc951d2381332e1aa48`](https://github.com/learningeconomy/LearnCard/commit/2c60b1a760958cbfe2525bc951d2381332e1aa48), [`4caf6a99c7a204d7f211737190d85eeebe736eb0`](https://github.com/learningeconomy/LearnCard/commit/4caf6a99c7a204d7f211737190d85eeebe736eb0)]:
+    - @learncard/types@6.0.0
+    - @learncard/email-templates@1.3.0
+    - @learncard/helpers@1.8.0
+    - @learncard/vc-plugin@1.7.0
+    - @learncard/encryption-plugin@1.2.0
+    - @learncard/credential-library@2.1.7
+    - @learncard/core@9.4.44
+    - @learncard/did-web-plugin@1.1.44
+    - @learncard/didkey-plugin@1.1.44
+    - @learncard/didkit-plugin@1.10.10
+    - @learncard/didkit-plugin-node@0.3.10
+    - @learncard/learn-card-plugin@1.2.44
+    - @learncard/vc-templates-plugin@1.1.44
+    - @learncard/crypto-plugin@1.1.44
+    - @learncard/dynamic-loader-plugin@1.1.44
+    - @learncard/expiration-plugin@1.2.44
+
+## 4.1.3
+
+### Patch Changes
+
+- Updated dependencies [[`27be1a449118c3c9b69f1fd961cf0b7fe3cbcdb6`](https://github.com/learningeconomy/LearnCard/commit/27be1a449118c3c9b69f1fd961cf0b7fe3cbcdb6)]:
+    - @learncard/types@5.24.2
+    - @learncard/credential-library@2.1.6
+    - @learncard/core@9.4.43
+    - @learncard/helpers@1.7.3
+    - @learncard/did-web-plugin@1.1.43
+    - @learncard/didkey-plugin@1.1.43
+    - @learncard/didkit-plugin@1.10.9
+    - @learncard/didkit-plugin-node@0.3.9
+    - @learncard/encryption-plugin@1.1.43
+    - @learncard/learn-card-plugin@1.2.43
+    - @learncard/vc-plugin@1.6.9
+    - @learncard/vc-templates-plugin@1.1.43
+    - @learncard/crypto-plugin@1.1.43
+    - @learncard/dynamic-loader-plugin@1.1.43
+    - @learncard/expiration-plugin@1.2.43
+
 ## 4.1.2
 
 ### Patch Changes

package/README.md

@@ -4,7 +4,7 @@ This service exposes the LearnCard Network API and local Neo4j-backed skills flo
 
 ## Live consent data for AI consumers
 
-`getConsentedDataForDid` returns data from live grants and authorized one-time grants (`oneTime: true`, stored with `status: 'stale'`) between the authenticated contract owner and the requested profile. Withdrawn grants and other stale grants are excluded. Term, contract and category expirations are enforced; empty expiry values mean no expiry, while malformed nonempty dates never authorize access. One-time means a fixed sharing grant, not a destructive read-once API; withdrawal still revokes subsequent retrieval. Malformed legacy terms are omitted rather than authorizing data or failing every grant in the response.
+`getConsentedDataForDid` returns data from live grants and authorized one-time grants (`oneTime: true`, stored with `status: 'consumed'`) between the authenticated contract owner and the requested profile. Pending and suspended updates retain reads under the user's previously accepted version; they do not enable newly requested data, writes, AutoBoosts, or synchronization. Withdrawn grants and consumed grants without the one-time flag are excluded. Term, contract and category expirations are enforced; empty expiry values mean no expiry, while malformed nonempty dates never authorize access. One-time means a fixed sharing grant, not a destructive read-once API; withdrawal still revokes subsequent retrieval. Malformed legacy terms are omitted rather than authorizing data or failing every grant in the response.
 
 - `termsUri`, `contractUri`, `status` and `terms` identify the current grant and its permissions.
 - `createdAt` is the original grant time when known. `date` is the latest consent update time. No historical timestamp is invented.
@@ -80,5 +80,31 @@ authorities, or contracts.
 
 ## Notes
 
+### Managed public status repair
+
+An issuer can call `credentialRefresh.attachStatusEntries({ refreshId, credentialStatus })`
+with the original signed credential's exact status descriptor. Object versus array shape,
+array order, and all descriptor fields must match the stored HMAC. The route validates
+local issuer-owned coordinates and reconciles an existing revocation or suspension.
+Credentials without supported public status entries cannot be repaired this way.
+
+New status fingerprints use `<keyVersion>:<base64url HMAC-SHA256>`. Configure
+`CREDENTIAL_REFRESH_DIGEST_KEY_VERSION` (default `v1`) with
+`CREDENTIAL_REFRESH_DIGEST_SECRET`. `CREDENTIAL_REFRESH_DIGEST_PREVIOUS_KEYS` is a JSON
+object mapping retained versions to their secret keys (default `{}`). Unversioned legacy
+fingerprints accept the current key or an explicitly retained previous key. Never log these
+secrets. Removing a previous key disables repair for fingerprints made with that key.
+
+Lifecycle mutations join the relationship update and status-list signing/write in one
+Neo4j transaction. A failed bit write rolls back the relationship, including unsuspension;
+retry the original mutation. No pending-sync worker is needed for these atomic writes.
+
+Managed versions share one status binding. Ordinary deliveries reserve their local
+coordinates under the same list locks and cannot reuse a managed credential's index.
+Binding and lifecycle writes lock the root, aggregate, then sorted status lists;
+attaching coordinates to an existing root also reconciles its lifecycle atomically.
+Legacy deliveries without public status metadata retain network-only lifecycle state;
+repair requires supported entries authenticated by the original status fingerprint.
+
 - The default fixture is idempotent by framework and skill ID, so running the seed command multiple times does not duplicate data.
 - Seeded skills are compatible with the existing skill search, boost alignment, and OBv3 alignment flows.

package/bootstrapLambda.test.ts

@@ -1,10 +1,18 @@
 import type { APIGatewayProxyEventV2, Context } from 'aws-lambda';
 import { beforeEach, expect, it, vi } from 'vitest';
 
-const mocks = vi.hoisted(() => ({ bootstrap: vi.fn(), getApp: vi.fn(), handler: vi.fn() }));
+const mocks = vi.hoisted(() => ({
+    bootstrap: vi.fn(),
+    getApp: vi.fn(),
+    handler: vi.fn(),
+    migrate: vi.fn(),
+}));
 
 vi.mock('@learncard/service-config', () => ({ bootstrapLambda: mocks.bootstrap }));
 vi.mock('./src/config/stageConfig', () => ({ base: {}, stages: { dev: {}, production: {} } }));
+vi.mock('./src/helpers/consentflow-legacy-migration.helpers', () => ({
+    migrateLegacyConsentFlowContracts: mocks.migrate,
+}));
 
 const LAMBDA_APP_HANDLERS = [
     'trpcHandler',
@@ -17,32 +25,20 @@ const LAMBDA_APP_HANDLERS = [
     'inboxQueueDispatcher',
     'inboxDeadLetterWorker',
     'notificationsWorker',
+    'campaignDispatchWorker',
+    'campaignUnsubscribeHandler',
     'inboxMaintenanceHandler',
 ] as const;
 
-vi.mock('./lambdaApp', () =>
-    Object.fromEntries(LAMBDA_APP_HANDLERS.map(name => [name, mocks.handler]))
-);
-
 beforeEach(() => {
     vi.resetModules();
     vi.clearAllMocks();
     mocks.bootstrap.mockReturnValue(mocks.getApp);
+    mocks.getApp.mockResolvedValue(
+        Object.fromEntries(LAMBDA_APP_HANDLERS.map(name => [name, mocks.handler]))
+    );
     mocks.handler.mockResolvedValue({ statusCode: 200 });
-});
-
-it('bootstraps the API once with checked-in stage config', async () => {
-    vi.stubEnv('AWS_LAMBDA_FUNCTION_NAME', 'lcn-brain-service-dev-trpc');
-    vi.stubEnv('LAMBDA_STAGE', 'dev');
-    await import('./lambda');
-    expect(mocks.bootstrap).toHaveBeenCalledTimes(1);
-    expect(mocks.bootstrap).toHaveBeenCalledWith({
-        base: {},
-        stages: { dev: {}, production: {} },
-        stage: 'dev',
-        importApp: expect.any(Function),
-    });
-    vi.unstubAllEnvs();
+    mocks.migrate.mockResolvedValue(undefined);
 });
 
 it('uses CONFIG_STAGE outside Lambda rather than LAMBDA_STAGE', async () => {
@@ -54,19 +50,61 @@ it('uses CONFIG_STAGE outside Lambda rather than LAMBDA_STAGE', async () => {
     vi.unstubAllEnvs();
 });
 
-it('forwards every handler through its bootstrap accessor', async () => {
-    mocks.getApp.mockResolvedValue(
-        Object.fromEntries(LAMBDA_APP_HANDLERS.map(name => [name, mocks.handler]))
+it.each(LAMBDA_APP_HANDLERS)('%s waits until legacy access is migrated', async handler => {
+    let finishMigration!: () => void;
+    mocks.migrate.mockReturnValue(
+        new Promise<void>(resolve => {
+            finishMigration = resolve;
+        })
     );
     const lambda = await import('./lambda');
-    const event = {} as APIGatewayProxyEventV2;
-    const context = {} as Context;
-    const callback = vi.fn();
-    for (const name of LAMBDA_APP_HANDLERS) {
-        await (lambda[name] as (...args: unknown[]) => Promise<unknown>)(event, context, callback);
-    }
-    expect(mocks.bootstrap).toHaveBeenCalledTimes(1);
-    expect(mocks.getApp).toHaveBeenCalledTimes(LAMBDA_APP_HANDLERS.length);
-    expect(mocks.handler).toHaveBeenCalledTimes(LAMBDA_APP_HANDLERS.length);
-    expect(mocks.handler).toHaveBeenCalledWith(event, context, callback);
+    let finished = false;
+    const request = lambda[handler]({} as never, {} as never, vi.fn()).finally(() => {
+        finished = true;
+    });
+    await vi.waitFor(() => expect(mocks.migrate).toHaveBeenCalled());
+    expect(finished).toBe(false);
+    finishMigration();
+    await request;
+    expect(finished).toBe(true);
+});
+
+it('retries a failed migration and serves concurrent and subsequent healthy requests', async () => {
+    const failure = new Error('Database unavailable');
+    let finishMigration!: () => void;
+    mocks.migrate
+        .mockRejectedValueOnce(failure)
+        .mockImplementationOnce(
+            () =>
+                new Promise<void>(resolve => {
+                    finishMigration = resolve;
+                })
+        )
+        .mockResolvedValue(undefined);
+    const lambda = await import('./lambda');
+    await expect(
+        lambda.trpcHandler({} as APIGatewayProxyEventV2, {} as Context, vi.fn())
+    ).rejects.toBe(failure);
+
+    let firstFinished = false;
+    let secondFinished = false;
+    const first = lambda
+        .trpcHandler({} as APIGatewayProxyEventV2, {} as Context, vi.fn())
+        .finally(() => {
+            firstFinished = true;
+        });
+    const second = lambda.openApiHandler({} as never, {} as never, vi.fn()).finally(() => {
+        secondFinished = true;
+    });
+    await vi.waitFor(() => expect(mocks.migrate).toHaveBeenCalledTimes(2));
+    expect(firstFinished).toBe(false);
+    expect(secondFinished).toBe(false);
+    finishMigration();
+    await Promise.all([first, second]);
+    expect(mocks.migrate).toHaveBeenCalledTimes(2);
+
+    await expect(
+        lambda.trpcHandler({} as APIGatewayProxyEventV2, {} as Context, vi.fn())
+    ).resolves.toEqual({ statusCode: 200 });
+    expect(mocks.migrate).toHaveBeenCalledTimes(2);
 });

package/config/config.dev.json

@@ -1,4 +1,5 @@
 {
+    "CAMPAIGN_APP_ORIGINS": "{\"learncard\":\"https://staging.learncard.ai\",\"vetpass\":\"https://staging.vetpass.app\"}",
     "CLIENT_APP_DOMAIN_NAME": "learncard.app",
     "CREDENTIAL_REFRESH_ENABLED": "true",
     "CREDENTIAL_REFRESH_NOTIFICATION_WINDOW_HOURS": "12",

package/config/config.example.json

@@ -1,4 +1,5 @@
 {
+    "CAMPAIGN_APP_ORIGINS": "{\"learncard\":\"https://example.com\"}",
     "CLIENT_APP_DOMAIN_NAME": "example.com",
     "CREDENTIAL_REFRESH_ENABLED": "false",
     "CREDENTIAL_REFRESH_NOTIFICATION_WINDOW_HOURS": "24",
@@ -13,8 +14,8 @@
     "SHARE_LINK_MAINTENANCE_ALLOW_INSECURE_LOOPBACK": "false",
     "SHARE_LINK_MAINTENANCE_AUDIENCE": "did:web:cloud.example.com",
     "SHARE_LINK_MAINTENANCE_BUDGET_MS": "60000",
-    "SHARE_LINK_MAINTENANCE_CLAIM_MS": "300000",
     "SHARE_LINK_MAINTENANCE_CLAIMANT": "brain-share-link-maintenance",
+    "SHARE_LINK_MAINTENANCE_CLAIM_MS": "300000",
     "SHARE_LINK_MAINTENANCE_CLEANUP_LIMIT": "25",
     "SHARE_LINK_MAINTENANCE_FINALIZE_RESERVE_MS": "5000",
     "SHARE_LINK_MAINTENANCE_GRAPH_TIMEOUT_MS": "15000",

package/config/config.production.json

@@ -1,4 +1,5 @@
 {
+    "CAMPAIGN_APP_ORIGINS": "{\"learncard\":\"https://learncard.app\",\"vetpass\":\"https://vetpass.app\"}",
     "CLIENT_APP_DOMAIN_NAME": "learncard.app",
     "CREDENTIAL_REFRESH_ENABLED": "true",
     "CREDENTIAL_REFRESH_NOTIFICATION_WINDOW_HOURS": "12",

package/config/config.scouts.dev.json

@@ -1,4 +1,5 @@
 {
+    "CAMPAIGN_APP_ORIGINS": "{\"scoutpass\":\"https://staging.pass.scout.org\"}",
     "CLIENT_APP_DOMAIN_NAME": "staging.pass.scout.org",
     "CREDENTIAL_REFRESH_ENABLED": "false",
     "CREDENTIAL_REFRESH_NOTIFICATION_WINDOW_HOURS": "24",

package/config/config.scouts.production.json

@@ -1,4 +1,5 @@
 {
+    "CAMPAIGN_APP_ORIGINS": "{\"scoutpass\":\"https://pass.scout.org\"}",
     "CLIENT_APP_DOMAIN_NAME": "pass.scout.org",
     "CREDENTIAL_REFRESH_ENABLED": "false",
     "CREDENTIAL_REFRESH_NOTIFICATION_WINDOW_HOURS": "24",

package/consentFlowDeadlineLambda.test.ts

@@ -0,0 +1,108 @@
+import type { Context } from 'aws-lambda';
+import { afterEach, beforeEach, expect, it, vi } from 'vitest';
+
+import baseConfig from './config/config.json';
+import devConfig from './config/config.dev.json';
+
+const { send, deadlineAppImport, databaseRun, loadedEnvironment } = vi.hoisted(() => ({
+    send: vi.fn(),
+    deadlineAppImport: vi.fn(),
+    databaseRun: vi.fn(),
+    loadedEnvironment: vi.fn(),
+}));
+
+vi.mock('@aws-sdk/client-secrets-manager', () => ({
+    SecretsManagerClient: class {
+        send = send;
+        destroy = vi.fn();
+    },
+    GetSecretValueCommand: class {
+        constructor(public input: { SecretId: string }) {}
+    },
+}));
+// Static imports would validate configuration before the cold-start secrets boundary.
+vi.mock('./consentFlowDeadlineLambdaApp', async importOriginal => {
+    deadlineAppImport();
+    return importOriginal();
+});
+vi.mock('./src/instance', async () => {
+    // Keep real import-time validation; replace only the database transport.
+    const { environment } = await import('./src/config/environment');
+    loadedEnvironment(environment);
+    return { neogma: { queryRunner: { run: databaseRun } } };
+});
+
+beforeEach(() => {
+    vi.resetModules();
+    send.mockReset();
+    deadlineAppImport.mockReset();
+    databaseRun.mockReset();
+    loadedEnvironment.mockReset();
+    for (const key of new Set([...Object.keys(baseConfig), ...Object.keys(devConfig)])) {
+        vi.stubEnv(key, undefined);
+    }
+    vi.stubEnv('DOTENV_CONFIG_PATH', '/dev/null');
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('CONFIG_TENANT', '');
+    vi.stubEnv('AWS_LAMBDA_FUNCTION_NAME', 'lcn-brain-service-dev-consentFlowDeadline');
+    vi.stubEnv('LAMBDA_STAGE', 'dev');
+    vi.stubEnv('RUNTIME_SECRETS_ID', 'brain-service/dev/runtime-secrets');
+});
+afterEach(() => {
+    vi.unstubAllEnvs();
+    vi.useRealTimers();
+});
+
+it('does not import or run deadline work when runtime secrets fail to load', async () => {
+    send.mockRejectedValue(new Error('secrets unavailable'));
+    const { consentFlowDeadlineHandler } = await import('./consentFlowDeadlineLambda');
+
+    await expect(
+        consentFlowDeadlineHandler({}, { getRemainingTimeInMillis: () => 30_000 } as Context)
+    ).rejects.toThrow('Unable to load runtime secrets bundle');
+    expect(deadlineAppImport).not.toHaveBeenCalled();
+});
+
+it('boots from the secrets bundle and keeps warm deadline work independent of secrets availability', async () => {
+    const secrets = {
+        SEED: 'a'.repeat(64),
+        NEO4J_URI: 'bolt://deadline-test:7687',
+        NEO4J_USERNAME: 'deadline-test',
+        NEO4J_PASSWORD: 'test-password',
+        CREDENTIAL_REFRESH_DIGEST_SECRET: 'deadline-test-refresh-digest',
+    };
+    for (const key of Object.keys(secrets)) vi.stubEnv(key, undefined);
+    send.mockImplementationOnce(async () => {
+        for (const key of Object.keys(secrets)) expect(process.env[key]).toBeUndefined();
+        expect(deadlineAppImport).not.toHaveBeenCalled();
+        return { SecretString: JSON.stringify(secrets) };
+    });
+    send.mockRejectedValue(new Error('Secrets Manager unavailable after cold start'));
+    databaseRun.mockResolvedValue({
+        records: [{ get: () => ({ toNumber: () => 2 }) }],
+    });
+    vi.useFakeTimers({ toFake: ['Date'] });
+    vi.setSystemTime(new Date('2026-01-02T00:00:00.000Z'));
+
+    const { consentFlowDeadlineHandler } = await import('./consentFlowDeadlineLambda');
+    expect(deadlineAppImport).not.toHaveBeenCalled();
+
+    // The forwarded context must prevent database writes after a slow cold start.
+    await expect(
+        consentFlowDeadlineHandler({}, { getRemainingTimeInMillis: () => 1_000 } as Context)
+    ).resolves.toEqual({ suspended: 0 });
+    expect(databaseRun).not.toHaveBeenCalled();
+    expect(loadedEnvironment).toHaveBeenCalledExactlyOnceWith(expect.objectContaining(secrets));
+
+    // Scheduled input cannot replace the server's cutoff, and a warm call needs no new fetch.
+    await expect(
+        consentFlowDeadlineHandler({ now: '2099-01-01T00:00:00.000Z' }, {
+            getRemainingTimeInMillis: () => 30_000,
+        } as Context)
+    ).resolves.toEqual({ suspended: 2 });
+    expect(databaseRun).toHaveBeenCalledExactlyOnceWith(expect.any(String), {
+        now: '2026-01-02T00:00:00.000Z',
+    });
+    expect(send).toHaveBeenCalledOnce();
+    expect(deadlineAppImport).toHaveBeenCalledOnce();
+});

package/consentFlowDeadlineLambda.ts

@@ -0,0 +1,18 @@
+import { bootstrapLambda } from '@learncard/service-config';
+import type { consentFlowDeadlineHandler as DeadlineHandler } from './consentFlowDeadlineLambdaApp';
+
+import { base, stages } from './src/config/stageConfig';
+
+type ConsentFlowDeadlineApp = { consentFlowDeadlineHandler: typeof DeadlineHandler };
+
+const getApplication = bootstrapLambda<ConsentFlowDeadlineApp>({
+    base,
+    stages,
+    stage: process.env.AWS_LAMBDA_FUNCTION_NAME
+        ? process.env.LAMBDA_STAGE
+        : process.env.CONFIG_STAGE,
+    importApp: () => import('./consentFlowDeadlineLambdaApp'),
+});
+
+export const consentFlowDeadlineHandler: typeof DeadlineHandler = (...args) =>
+    getApplication().then(app => app.consentFlowDeadlineHandler(...args));

package/consentFlowDeadlineLambdaApp.ts

@@ -0,0 +1,14 @@
+import type { Context } from 'aws-lambda';
+import {
+    suspendExpiredConsentFlowTerms,
+    type ConsentFlowDeadlineSummary,
+} from './src/helpers/consentflow-deadline.helpers';
+
+/** Apply expired consent review deadlines; scheduled input cannot alter the cutoff. */
+export const consentFlowDeadlineHandler = async (
+    _event: unknown,
+    context?: Pick<Context, 'getRemainingTimeInMillis'>
+): Promise<ConsentFlowDeadlineSummary> => {
+    if ((context?.getRemainingTimeInMillis() ?? 10_000) < 2_000) return { suspended: 0 };
+    return suspendExpiredConsentFlowTerms();
+};

package/dist/accesslayer/boost/create.d.ts

@@ -1,8 +1,14 @@
-import { UnsignedVC, VC } from '@learncard/types';
+import { UnsignedVC, VC, type CredentialDisplay } from '@learncard/types';
 import { BoostInstance } from '../.././models/index';
 import { BoostType } from '../../types/boost';
 import { ProfileType } from '../../types/profile';
 import { AppStoreListingType } from '../../types/app-store-listing';
-export declare const createBoost: (credential: UnsignedVC | VC, creator: ProfileType, metadata: Omit<BoostType, "id" | "boost"> | undefined, domain: string) => Promise<BoostInstance>;
+export declare const createBoost: (credential: UnsignedVC | VC | null, creator: ProfileType, metadata: Omit<BoostType, "id" | "boost"> | undefined, domain: string, publicDisplay?: CredentialDisplay) => Promise<BoostInstance>;
+export declare const normalizePublicDisplay: (display: CredentialDisplay | undefined, template?: {
+    category?: string | null;
+}) => CredentialDisplay;
+export declare const createDisplayOnlyBoost: (display: CredentialDisplay | undefined, creator: ProfileType, domain: string, template?: {
+    category?: string | null;
+}) => Promise<BoostInstance>;
 export declare const createBoostForListing: (credential: UnsignedVC | VC, listing: AppStoreListingType, metadata: Omit<BoostType, "id" | "boost"> | undefined, domain: string) => Promise<BoostInstance>;
 //# sourceMappingURL=create.d.ts.map

package/dist/accesslayer/boost/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/boost/create.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EAAS,aAAa,EAA4B,MAAM,SAAS,CAAC;AACzE,OAAO,EAAe,SAAS,EAAE,MAAM,aAAa,CAAC;AAMrD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,eAAO,MAAM,WAAW,GACpB,YAAY,UAAU,GAAG,EAAE,EAC3B,SAAS,WAAW,EACpB,UAAU,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,YAAK,EAC9C,QAAQ,MAAM,KACf,OAAO,CAAC,aAAa,CA6CvB,CAAC;AAMF,eAAO,MAAM,qBAAqB,GAC9B,YAAY,UAAU,GAAG,EAAE,EAC3B,SAAS,mBAAmB,EAC5B,UAAU,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,YAAK,EAC9C,QAAQ,MAAM,KACf,OAAO,CAAC,aAAa,CA2CvB,CAAC"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/boost/create.ts"],"names":[],"mappings":"AACA,OAAO,EACH,UAAU,EACV,EAAE,EAEF,KAAK,iBAAiB,EACzB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAS,aAAa,EAA4B,MAAM,SAAS,CAAC;AACzE,OAAO,EAAe,SAAS,EAAE,MAAM,aAAa,CAAC;AAMrD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,eAAO,MAAM,WAAW,GACpB,YAAY,UAAU,GAAG,EAAE,GAAG,IAAI,EAClC,SAAS,WAAW,EACpB,UAAU,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,YAAK,EAC9C,QAAQ,MAAM,EACd,gBAAgB,iBAAiB,KAClC,OAAO,CAAC,aAAa,CAuDvB,CAAC;AAWF,eAAO,MAAM,sBAAsB,GAC/B,SAAS,iBAAiB,GAAG,SAAS,EACtC,WAAW;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,KACxC,iBAMF,CAAC;AAIF,eAAO,MAAM,sBAAsB,GAC/B,SAAS,iBAAiB,GAAG,SAAS,EACtC,SAAS,WAAW,EACpB,QAAQ,MAAM,EACd,WAAW;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,KACxC,OAAO,CAAC,aAAa,CASvB,CAAC;AAMF,eAAO,MAAM,qBAAqB,GAC9B,YAAY,UAAU,GAAG,EAAE,EAC3B,SAAS,mBAAmB,EAC5B,UAAU,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,YAAK,EAC9C,QAAQ,MAAM,KACf,OAAO,CAAC,aAAa,CA2CvB,CAAC"}

package/dist/accesslayer/campaign/audience.d.ts

@@ -1,7 +1,7 @@
-import { type CampaignAudienceSource, type PaginatedCampaignAudience } from '@learncard/types';
+import { type CampaignAudienceSource, type CampaignAudienceResult, type PaginatedCampaignAudience } from '@learncard/types';
 import type { CampaignAudienceQuery } from '../../types/campaign';
 export declare const buildCampaignAudienceQuery: (rawSource: CampaignAudienceSource, domain: string) => CampaignAudienceQuery;
-export declare const previewCampaignAudience: (campaignId: string, source: CampaignAudienceSource, domain: string) => Promise<number>;
-export declare const addCampaignAudience: (campaignId: string, source: CampaignAudienceSource, domain: string) => Promise<number>;
-export declare const pageCampaignAudience: (campaignId: string, cursor?: string, limit?: number) => Promise<PaginatedCampaignAudience>;
+export declare const previewCampaignAudience: (campaignId: string, source: CampaignAudienceSource, domain: string) => Promise<CampaignAudienceResult>;
+export declare const addCampaignAudience: (campaignId: string, source: CampaignAudienceSource, domain: string) => Promise<CampaignAudienceResult>;
+export declare const pageCampaignAudience: (campaignId: string, cursor?: string, limit?: number, deliveryChannel?: "email") => Promise<PaginatedCampaignAudience>;
 //# sourceMappingURL=audience.d.ts.map

package/dist/accesslayer/campaign/audience.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audience.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/campaign/audience.ts"],"names":[],"mappings":"AAEA,OAAO,EAEH,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EACjC,MAAM,kBAAkB,CAAC;AAM1B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAgB5D,eAAO,MAAM,0BAA0B,GACnC,WAAW,sBAAsB,EACjC,QAAQ,MAAM,KACf,qBA4DF,CAAC;AAEF,eAAO,MAAM,uBAAuB,GAChC,YAAY,MAAM,EAClB,QAAQ,sBAAsB,EAC9B,QAAQ,MAAM,KACf,OAAO,CAAC,MAAM,CAWhB,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAC5B,YAAY,MAAM,EAClB,QAAQ,sBAAsB,EAC9B,QAAQ,MAAM,KACf,OAAO,CAAC,MAAM,CAchB,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAC7B,YAAY,MAAM,EAClB,SAAS,MAAM,EACf,cAAW,KACZ,OAAO,CAAC,yBAAyB,CAiBnC,CAAC"}
+{"version":3,"file":"audience.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/campaign/audience.ts"],"names":[],"mappings":"AAEA,OAAO,EAEH,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EACjC,MAAM,kBAAkB,CAAC;AAM1B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAiB5D,eAAO,MAAM,0BAA0B,GACnC,WAAW,sBAAsB,EACjC,QAAQ,MAAM,KACf,qBA4DF,CAAC;AAmBF,eAAO,MAAM,uBAAuB,GAChC,YAAY,MAAM,EAClB,QAAQ,sBAAsB,EAC9B,QAAQ,MAAM,KACf,OAAO,CAAC,sBAAsB,CAehC,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAC5B,YAAY,MAAM,EAClB,QAAQ,sBAAsB,EAC9B,QAAQ,MAAM,KACf,OAAO,CAAC,sBAAsB,CAqBhC,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAC7B,YAAY,MAAM,EAClB,SAAS,MAAM,EACf,cAAW,EACX,kBAAkB,OAAO,KAC1B,OAAO,CAAC,yBAAyB,CAkBnC,CAAC"}

package/dist/accesslayer/campaign/create.d.ts

@@ -1,3 +1,3 @@
 import { type Campaign, type CreateCampaignInput } from '@learncard/types';
-export declare const createCampaign: (input: CreateCampaignInput, createdByProfileId: string) => Promise<Campaign>;
+export declare const createCampaign: (input: CreateCampaignInput, createdByProfileId: string, tenantId?: string) => Promise<Campaign>;
 //# sourceMappingURL=create.d.ts.map

package/dist/accesslayer/campaign/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/campaign/create.ts"],"names":[],"mappings":"AACA,OAAO,EAGH,KAAK,QAAQ,EACb,KAAK,mBAAmB,EAC3B,MAAM,kBAAkB,CAAC;AAO1B,eAAO,MAAM,cAAc,GACvB,OAAO,mBAAmB,EAC1B,oBAAoB,MAAM,KAC3B,OAAO,CAAC,QAAQ,CA8BlB,CAAC"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/campaign/create.ts"],"names":[],"mappings":"AACA,OAAO,EAGH,KAAK,QAAQ,EACb,KAAK,mBAAmB,EAC3B,MAAM,kBAAkB,CAAC;AAO1B,eAAO,MAAM,cAAc,GACvB,OAAO,mBAAmB,EAC1B,oBAAoB,MAAM,EAC1B,WAAW,MAAM,KAClB,OAAO,CAAC,QAAQ,CA+BlB,CAAC"}