[LC-1423] X-API Scoped by Contract

.changeset/pretty-masks-poke.md

@@ -0,0 +1,5 @@
+---
+'@learncard/learn-cloud-service': patch
+---
+
+Tag X-API Statements with Contract URI

.changeset/wild-regions-begin.md

@@ -0,0 +1,5 @@
+---
+'learn-card-app': patch
+---
+
+Add Contract URI to JWTs so that X-API statements are tagged by contract

apps/learn-card-app/src/pages/consentFlow/ExternalConsentFlowDoor.tsx

@@ -225,10 +225,16 @@ const ExternalConsentFlowDoor: React.FC<{ login: boolean }> = ({ login = false }
                                                     unsignedDelegateCredential
                                                 );
 
-                                            const unsignedDidAuthVp =
+                                            const unsignedDidAuthVp: any =
                                                 await wallet.invoke.newPresentation(
                                                     delegateCredential
                                                 );
+
+                                            // Add contractUri to VP before signing for xAPI tracking
+                                            if (uri && typeof uri === 'string') {
+                                                unsignedDidAuthVp.contractUri = uri;
+                                            }
+
                                             const vp = (await wallet.invoke.issuePresentation(
                                                 unsignedDidAuthVp,
                                                 {

apps/learn-card-app/src/pages/consentFlow/FullScreenConsentFlow.tsx

@@ -165,9 +165,15 @@ const FullScreenConsentFlow: React.FC<FullScreenConsentFlowProps> = ({
                                 unsignedDelegateCredential
                             );
 
-                            const unsignedDidAuthVp = await wallet.invoke.newPresentation(
+                            const unsignedDidAuthVp: any = await wallet.invoke.newPresentation(
                                 delegateCredential
                             );
+
+                            // Add contractUri to VP before signing for xAPI tracking
+                            if (contractDetails?.uri) {
+                                unsignedDidAuthVp.contractUri = contractDetails.uri;
+                            }
+
                             const vp = (await wallet.invoke.issuePresentation(unsignedDidAuthVp, {
                                 proofPurpose: 'authentication',
                                 proofFormat: 'jwt',

docs/core-concepts/consent-and-permissions/writing-consented-data.md

@@ -33,8 +33,8 @@ For more details on the `send` method, see the [Send Credentials How-To Guide](.
 
 For more granular control, contract owners can write credentials directly to profiles that have consented using:
 
-* `writeCredentialToContract`: Direct credential writing
-* `writeCredentialToContractViaSigningAuthority`: Using a signing authority
+-   `writeCredentialToContract`: Direct credential writing
+-   `writeCredentialToContractViaSigningAuthority`: Using a signing authority
 
 ```mermaid
 sequenceDiagram