@learncard/network-brain-service 3.18.0 → 3.19.1

package/src/helpers/inbox.helpers.ts

@@ -1,4 +1,19 @@
+import { environment } from '@environment';
+import { recordInboxRefreshClaimUrl } from '@accesslayer/inbox-credential/refresh';
+import { randomUUID } from 'node:crypto';
+import {
+    assertInboxRefreshEnabled,
+    prepareInboxRefresh,
+    getInboxRefreshReceipt,
+    finalizeInboxRefresh,
+    getInboxRefreshIssueKey,
+    resumeInboxRefreshDelivery,
+} from './inbox-refresh.helpers';
 import { TRPCError } from '@trpc/server';
+import {
+    InboxDeliveryCheckpointError,
+    InboxIssuancePreflightError,
+} from './inbox-issuance-error.helpers';
 import {
     VC,
     UnsignedVC,
@@ -32,7 +47,7 @@ import { doesProfileManageProfile } from '@accesslayer/profile-manager/relations
 import { getProfilesThatManageAProfile } from '@accesslayer/profile/relationships/read';
 import { getProfileForInboxCredential } from '@accesslayer/inbox-credential/read';
 import { sendCredential } from '@helpers/credential.helpers';
-import { sendBoost } from '@helpers/boost.helpers';
+import { prepareCredentialFromBoost, getBoostUri, sendBoost } from '@helpers/boost.helpers';
 import { getBoostByUri } from '@accesslayer/boost/read';
 import { issueCredentialWithSigningAuthority } from '@helpers/signingAuthority.helpers';
 import { getSigningAuthorityForUserByName } from '@accesslayer/signing-authority/relationships/read';
@@ -192,9 +207,15 @@ export const issueToInbox = async (
         activityId?: string;
         integrationId?: string;
         guardianEmail?: string;
+        refresh?: boolean;
+        idempotencyKey?: string;
+        refreshRequestDigest?: string;
     } = {},
-    ctx: Context
+    ctx: Context,
+    /** Queue ownership checkpoint immediately before delivery or inbox persistence. */
+    beforeDelivery?: () => Promise<void>
 ): Promise<{
+    refresh?: import('@learncard/types').InboxCredentialRefreshReceipt;
     status: 'PENDING' | 'ISSUED' | 'EXPIRED' | 'DELIVERED' | 'CLAIMED'; // DELIVERED & CLAIMED are deprecated, use ISSUED
     inboxCredential: InboxCredentialType;
     claimUrl?: string;
@@ -211,13 +232,35 @@ export const issueToInbox = async (
         integrationId,
         guardianEmail,
     } = configuration;
+    if (configuration.refresh) {
+        await assertInboxRefreshEnabled(ctx.user?.scope);
+        if (
+            credential.proof ||
+            credential.type.includes('VerifiablePresentation') ||
+            Array.isArray(credential.credentialSubject)
+        ) {
+            throw new TRPCError({
+                code: 'BAD_REQUEST',
+                message:
+                    'Inbox refresh requires an unsigned credential with a single subject and a signing authority.',
+            });
+        }
+    }
     const isSigned = !!credential?.proof;
     let signingAuthority: IssueInboxSigningAuthority | undefined = _signingAuthority;
+    let deliveryCheckpointReached = beforeDelivery === undefined;
+    const checkpointDelivery = async (): Promise<void> => {
+        await beforeDelivery?.();
+        deliveryCheckpointReached = true;
+    };
+    const assertDeliveryCheckpoint = (result: InboxDeliveryCheckpointError['result']): void => {
+        if (!deliveryCheckpointReached) throw new InboxDeliveryCheckpointError(result);
+    };
 
     if (recipient.type === 'phone') {
         const isTrusted = await getRegistryService().isTrusted(issuerProfile.did);
         if (!isTrusted) {
-            throw new TRPCError({
+            throw new InboxIssuancePreflightError({
                 code: 'FORBIDDEN',
                 message:
                     'Sending credentials via phone is a feature reserved for members of the LearnCard Trusted Registry. Email delivery is available for all issuers. To verify your issuer, visit: https://docs.learncard.com/how-to-guides/verify-my-issuer',
@@ -245,20 +288,35 @@ export const issueToInbox = async (
              * By providing this parameter, the developer explicitly takes responsibility for the signing process. We trust them and proceed.
              **/
             if (!(await verifyCredentialCanBeSigned(credential as UnsignedVC))) {
-                throw new TRPCError({
+                throw new InboxIssuancePreflightError({
                     code: 'BAD_REQUEST',
                     message:
                         'Credential failed to pass a pre-flight issuance test. Please verify that the credential is well-formed and can be issued.',
                 });
             }
         } else {
-            throw new TRPCError({
+            throw new InboxIssuancePreflightError({
                 code: 'BAD_REQUEST',
                 message: 'Unsigned credentials require a signing authority',
             });
         }
     }
 
+    if (
+        configuration.refresh &&
+        (!signingAuthority ||
+            !(await getSigningAuthorityForUserByName(
+                issuerProfile,
+                signingAuthority.endpoint,
+                signingAuthority.name
+            )))
+    ) {
+        throw new TRPCError({
+            code: 'NOT_FOUND',
+            message: 'Signing authority not found for issuer',
+        });
+    }
+
     // Check if recipient already exists with verified email
     const existingProfile = await getProfileByVerifiedContactMethod(
         recipient.type,
@@ -267,12 +325,14 @@ export const issueToInbox = async (
 
     // Check if the recipient is a managed child (has a guardian via MANAGES relationship).
     // Managed children need guardian approval for all inbox credentials, even without explicit guardianEmail.
-    const recipientManagers = existingProfile
-        ? await getProfilesThatManageAProfile(existingProfile.profileId)
-        : [];
+    // Service profiles (orgs) are managed for admin purposes, not guardianship.
+    const recipientManagers =
+        existingProfile && !existingProfile.isServiceProfile
+            ? await getProfilesThatManageAProfile(existingProfile.profileId)
+            : [];
     const recipientIsManaged = recipientManagers.length > 0;
 
-    if (existingProfile && !guardianEmail && !recipientIsManaged) {
+    if (existingProfile && !guardianEmail && !recipientIsManaged && !configuration.refresh) {
         // Auto-deliver to existing user
         let finalCredential: VC;
 
@@ -287,7 +347,7 @@ export const issueToInbox = async (
             );
 
             if (!signingAuthorityForUser) {
-                throw new TRPCError({
+                throw new InboxIssuancePreflightError({
                     code: 'NOT_FOUND',
                     message: 'Signing authority not found for issuer',
                 });
@@ -317,31 +377,20 @@ export const issueToInbox = async (
             credential: encryptedDelivery,
             statusEntries: getBitstringStatusListEntries(finalCredential),
         };
-        if (boostUri) {
-            const boost = await getBoostByUri(boostUri);
-            if (boost) {
-                await sendBoost({
-                    from: { type: 'profile', profile: issuerProfile },
-                    to: existingProfile,
-                    boost,
-                    credential: delivery,
-                    domain: ctx.domain,
-                    activityId,
-                    integrationId,
-                });
-            } else {
-                // Fallback to sendCredential if boost not found
-                await sendCredential(
-                    issuerProfile,
-                    existingProfile,
-                    delivery,
-                    ctx.domain,
-                    undefined,
-                    activityId,
-                    integrationId
-                );
-            }
+        const boost = boostUri ? await getBoostByUri(boostUri) : undefined;
+        await checkpointDelivery();
+        if (boostUri && boost) {
+            await sendBoost({
+                from: { type: 'profile', profile: issuerProfile },
+                to: existingProfile,
+                boost,
+                credential: delivery,
+                domain: ctx.domain,
+                activityId,
+                integrationId,
+            });
         } else {
+            // Fall back to ordinary delivery when no boost exists for the supplied URI.
             await sendCredential(
                 issuerProfile,
                 existingProfile,
@@ -372,6 +421,7 @@ export const issueToInbox = async (
             await logCredentialDelivered({
                 activityId,
                 actorProfileId: issuerProfile.profileId,
+                onBehalfOf: ctx.user?.onBehalfOf,
                 recipientType: recipient.type as 'email' | 'phone',
                 recipientIdentifier: recipient.value,
                 recipientProfileId: existingProfile.profileId,
@@ -420,6 +470,11 @@ export const issueToInbox = async (
             });
         }
 
+        assertDeliveryCheckpoint({
+            issuanceId: finalizedInboxCredential.id,
+            status: LCNInboxStatusEnumValidator.enum.ISSUED,
+            recipientDid: existingProfile.did,
+        });
         return {
             status: LCNInboxStatusEnumValidator.enum.ISSUED,
             inboxCredential: finalizedInboxCredential,
@@ -429,7 +484,24 @@ export const issueToInbox = async (
         // Store in inbox for claiming
         // Guardian gate if issuer specified guardianEmail OR recipient is a managed child
         const needsGuardianGate = !!guardianEmail || recipientIsManaged;
+        const preparedRefresh = configuration.refresh
+            ? await prepareInboxRefresh(credential, issuerProfile, ctx.domain)
+            : undefined;
+        if (preparedRefresh) credential = preparedRefresh.credential;
+        await checkpointDelivery();
         const inboxCredential = await createInboxCredential({
+            ...(preparedRefresh
+                ? {
+                      refresh: {
+                          aggregate: preparedRefresh.aggregate,
+                          issueKey: getInboxRefreshIssueKey(
+                              issuerProfile.profileId,
+                              configuration.idempotencyKey ?? randomUUID()
+                          ),
+                          requestDigest: configuration.refreshRequestDigest!,
+                      },
+                  }
+                : {}),
             credential: JSON.stringify(credential),
             isSigned,
             recipient,
@@ -444,6 +516,101 @@ export const issueToInbox = async (
             ...(needsGuardianGate ? { guardianStatus: 'AWAITING_GUARDIAN' as const } : {}),
         });
 
+        const refresh = inboxCredential.refreshId
+            ? await getInboxRefreshReceipt(inboxCredential.refreshId, ctx.domain)
+            : undefined;
+        if (refresh && existingProfile && !needsGuardianGate) {
+            await finalizeInboxRefresh({
+                inboxId: inboxCredential.id,
+                holderDid: existingProfile.did,
+                holderProfile: existingProfile,
+                domain: ctx.domain,
+                accepted: false,
+            });
+            await resumeInboxRefreshDelivery(refresh.refreshId, ctx.domain);
+            await createDeliveredRelationship(
+                issuerProfile.profileId,
+                inboxCredential.id,
+                existingProfile.did,
+                'auto-delivery'
+            );
+            if (activityId)
+                await logCredentialDelivered({
+                    activityId,
+                    actorProfileId: issuerProfile.profileId,
+                    onBehalfOf: ctx.user?.onBehalfOf,
+                    recipientType: recipient.type,
+                    recipientIdentifier: recipient.value,
+                    recipientProfileId: existingProfile.profileId,
+                    boostUri,
+                    inboxCredentialId: inboxCredential.id,
+                    integrationId,
+                    source: 'send',
+                });
+            if (webhookUrl)
+                await addNotificationToQueue({
+                    webhookUrl,
+                    type: LCNNotificationTypeEnumValidator.enum.ISSUANCE_DELIVERED,
+                    from: { did: (await getLearnCard()).id.did() },
+                    to: issuerProfile,
+                    message: getNotificationMessage(
+                        'issuanceDelivered',
+                        resolveRecipientLocale(issuerProfile),
+                        {
+                            issuer: issuerProfile.displayName,
+                            recipientType: recipient.type,
+                            recipientValue: recipient.value,
+                        }
+                    ),
+                    data: {
+                        inbox: {
+                            issuanceId: inboxCredential.id,
+                            status: LCNInboxStatusEnumValidator.enum.ISSUED,
+                            recipient: {
+                                contactMethod: recipient,
+                                learnCardId: existingProfile.did,
+                            },
+                            timestamp: new Date().toISOString(),
+                        },
+                    },
+                });
+            // Existing accounts receive the signed credential in their app inbox.
+            // Send the email there too, without a claim token for an already-bound delivery.
+            if (recipient.type === 'email' && !delivery?.suppress) {
+                try {
+                    const appUrl = environment.IS_OFFLINE
+                        ? generateClaimUrl('')
+                        : ctx.tenant?.emailBranding?.appUrl || generateClaimUrl('');
+                    await getDeliveryService(recipient).send({
+                        contactMethod: recipient,
+                        templateId: 'universal-inbox-claim',
+                        templateModel: {
+                            claimUrl: new URL('/notifications', appUrl).href,
+                            issuer: { name: issuerProfile.displayName },
+                            credential: { name: credential.name },
+                        },
+                        branding: ctx.tenant?.emailBranding,
+                        locale: resolveRecipientLocale(existingProfile),
+                        messageStream: 'universal-inbox',
+                    });
+                } catch {
+                    // The credential and in-app notification are already durable. An
+                    // email transport failure must not turn that delivery into an error.
+                    console.warn('Inbox refresh: initial email failed after auto-delivery.');
+                }
+            }
+            return {
+                status: 'ISSUED',
+                inboxCredential: {
+                    ...inboxCredential,
+                    currentStatus: 'ISSUED',
+                    credential: undefined,
+                },
+                recipientDid: existingProfile.did,
+                refresh: { ...refresh, holderDid: existingProfile.did },
+            };
+        }
+
         // Generate claim token
         let recipientContactMethod = await getContactMethodByValue(recipient.type, recipient.value);
         if (!recipientContactMethod) {
@@ -712,8 +879,9 @@ export const issueToInbox = async (
 
                 await deliveryService.send({
                     contactMethod: recipient,
-                    templateId: delivery?.template?.id ?? 'universal-inbox',
+                    templateId: delivery?.template?.id || 'universal-inbox-claim',
                     templateModel: {
+                        claimUrl: emailClaimUrl,
                         emailClaimUrl,
                         claimToken: emailClaimToken,
                         ...injectedTemplateFields,
@@ -817,13 +985,84 @@ export const issueToInbox = async (
             expiresInDays ? 24 * expiresInDays : 24,
             false
         );
-        const claimUrl = generateClaimUrl(claimToken);
+        const claimUrl = refresh
+            ? await recordInboxRefreshClaimUrl(inboxCredential.id, generateClaimUrl(claimToken))
+            : generateClaimUrl(claimToken);
 
+        assertDeliveryCheckpoint({
+            issuanceId: inboxCredential.id,
+            status: LCNInboxStatusEnumValidator.enum.PENDING,
+            claimUrl,
+            ...(guardianEmail ? { guardianStatus: 'AWAITING_GUARDIAN' as const } : {}),
+        });
         return {
             status: LCNInboxStatusEnumValidator.enum.PENDING,
             inboxCredential,
             claimUrl,
+            ...(refresh ? { refresh } : {}),
             ...(guardianEmail ? { guardianStatus: 'AWAITING_GUARDIAN' as const } : {}),
         };
     }
 };
+
+/**
+ * Resolves an input into the credential that issueToInbox consumes. Keeping this outside either
+ * route makes direct credentials and Boost templates behave identically for single and batch
+ * issuance, including template rendering, Boost metadata, and standard client-facing errors.
+ */
+export const resolveInboxCredentialInput = async (
+    input: IssueInboxCredentialType,
+    ctx: Context
+): Promise<{ credential: VC | UnsignedVC | VP; resolvedBoostUri?: string }> => {
+    const { templateUri, configuration } = input;
+    // A direct credential wins when both fields are present, matching the existing single-route
+    // behavior. A template is only loaded when the caller supplied no credential.
+    let credential = input.credential;
+    let resolvedBoostUri: string | undefined;
+
+    if (templateUri && !credential) {
+        const boostInstance = await getBoostByUri(templateUri);
+
+        if (!boostInstance) {
+            throw new TRPCError({
+                code: 'NOT_FOUND',
+                message: `Boost not found: ${templateUri}`,
+            });
+        }
+
+        if (!boostInstance.dataValues.boost) {
+            throw new TRPCError({
+                code: 'BAD_REQUEST',
+                message: `Boost does not contain a credential template: ${templateUri}`,
+            });
+        }
+
+        try {
+            // Use shared helper to prepare credential with templateData rendering,
+            // issuance date, boostId injection, and OBv3 alignments
+            resolvedBoostUri = getBoostUri(boostInstance.id, ctx.domain);
+
+            credential = await prepareCredentialFromBoost(
+                boostInstance,
+                resolvedBoostUri,
+                ctx.domain,
+                { templateData: configuration?.templateData as Record<string, unknown> }
+            );
+        } catch (e) {
+            console.error('Failed to prepare boost credential', e);
+            throw new TRPCError({
+                code: 'BAD_REQUEST',
+                message: `Failed to prepare boost credential template: ${templateUri}`,
+            });
+        }
+    }
+
+    if (!credential) {
+        throw new TRPCError({
+            code: 'BAD_REQUEST',
+            message: 'Either credential or templateUri must be provided',
+        });
+    }
+
+    return { credential, resolvedBoostUri };
+};

package/src/helpers/notificationMessages.ts

@@ -57,7 +57,8 @@ export type NotificationMessageKey =
     | 'credentialRestoredUnnamed'
     // --- Managed credential refresh (LC-2136) — generic copy only: never name the
     // credential, the holder's claims, or implementation terms (refresh/sync/etc.) ---
-    | 'credentialRefreshed';
+    | 'credentialRefreshed'
+    | 'shareViewed';
 
 type MessageTemplate = { title: string; body: string };
 type LocaleCatalog = Record<NotificationMessageKey, MessageTemplate>;
@@ -216,6 +217,10 @@ const en: LocaleCatalog = {
         title: 'Credential updated',
         body: '{from} updated one of your credentials.',
     },
+    shareViewed: {
+        title: 'Share viewed',
+        body: 'Your share “{title} ({count})” was viewed.',
+    },
 };
 
 const es: LocaleCatalog = {
@@ -367,6 +372,10 @@ const es: LocaleCatalog = {
         title: 'Credencial actualizada',
         body: '{from} actualizó una de tus credenciales.',
     },
+    shareViewed: {
+        title: 'Enlace visto',
+        body: 'Se vio tu enlace «{title} ({count})».',
+    },
 };
 
 const fr: LocaleCatalog = {
@@ -518,6 +527,10 @@ const fr: LocaleCatalog = {
         title: 'Titre mis à jour',
         body: "{from} a mis à jour l'un de vos titres.",
     },
+    shareViewed: {
+        title: 'Partage consulté',
+        body: 'Votre partage « {title} ({count}) » a été consulté.',
+    },
 };
 
 const ar: LocaleCatalog = {
@@ -669,6 +682,10 @@ const ar: LocaleCatalog = {
         title: 'تم تحديث الشهادة',
         body: 'قام {from} بتحديث إحدى شهاداتك.',
     },
+    shareViewed: {
+        title: 'تمت مشاهدة المشاركة',
+        body: 'تمت مشاهدة مشاركتك «{title} ({count})».',
+    },
 };
 
 const CATALOGS: Record<NotificationLocale, LocaleCatalog> = { en, es, fr, ar };

package/src/helpers/notifications.helpers.ts

@@ -223,8 +223,10 @@ export const buildCredentialRefreshedNotification = (
     return {
         notification: {
             type: LCNNotificationTypeEnumValidator.enum.CREDENTIAL_REFRESHED,
-            to: holderProfile,
-            from: issuerProfile,
+            // Local webhook delivery normalizes these DIDs in place. Keep the
+            // database profiles intact for the subsequent verified-email lookup.
+            to: { ...holderProfile },
+            from: { ...issuerProfile },
             message: getNotificationMessage(
                 'credentialRefreshed',
                 resolveRecipientLocale(holderProfile),

package/src/helpers/presentation-metadata.ts

@@ -0,0 +1,41 @@
+import { TRPCError } from '@trpc/server';
+import { ShareLinkIdValidator } from '@learncard/types';
+import { z } from 'zod';
+
+// Relationship metadata is not signed VP content. Bound generic metadata and
+// reserve the share-link shape for the recipient's own send/accept workflow.
+const ShareLinkPresentationMetadataValidator = z
+    .object({
+        type: z.literal('learncard.share-link.v1'),
+        shareId: ShareLinkIdValidator,
+        title: z.string().min(1).max(120),
+        note: z.string().max(500).optional(),
+        sharer: z
+            .object({
+                profileId: z.string().min(1).max(128),
+                displayName: z.string().min(1).max(120),
+            })
+            .strict(),
+    })
+    .strict();
+
+export const PresentationMetadataValidator = z
+    .record(z.string().min(1).max(64), z.unknown())
+    .refine(value => JSON.stringify(value).length <= 4096, 'Metadata is too large')
+    .superRefine((value, ctx) => {
+        if (value.type !== 'learncard.share-link.v1') return;
+        if (!ShareLinkPresentationMetadataValidator.safeParse(value).success)
+            ctx.addIssue({ code: 'custom', message: 'Invalid share-link metadata' });
+    });
+
+export const assertPresentationMetadataRecipient = (
+    metadata: Record<string, unknown> | undefined,
+    senderProfileId: string,
+    recipientProfileId: string
+): void => {
+    if (metadata?.type === 'learncard.share-link.v1' && senderProfileId !== recipientProfileId)
+        throw new TRPCError({
+            code: 'BAD_REQUEST',
+            message: 'Share-link metadata requires a self-save',
+        });
+};

package/src/helpers/presentation.helpers.ts

@@ -23,23 +23,29 @@ export const sendPresentation = async (
     from: ProfileType,
     to: ProfileType,
     presentation: VP | JWE,
-    domain: string
+    domain: string,
+    metadata?: Record<string, unknown>
 ): Promise<string> => {
     const presentationInstance = await storePresentation(presentation);
 
-    await createSentPresentationRelationship(from, to, presentationInstance);
+    await createSentPresentationRelationship(from, to, presentationInstance, metadata);
 
-    let uri = getPresentationUri(presentationInstance.id, domain);
+    const uri = getPresentationUri(presentationInstance.id, domain);
 
-    await addNotificationToQueue({
-        type: LCNNotificationTypeEnumValidator.enum.PRESENTATION_RECEIVED,
-        to,
-        from,
-        message: getNotificationMessage('presentationReceived', resolveRecipientLocale(to), {
-            from: from.displayName,
-        }),
-        data: { vpUris: [uri] },
-    });
+    // Saving a shared collection reuses the presentation send/accept pipeline by
+    // sending it to the current profile. Keep that storage behavior without
+    // creating a meaningless "you sent this to yourself" recipient alert.
+    if (from.profileId !== to.profileId) {
+        await addNotificationToQueue({
+            type: LCNNotificationTypeEnumValidator.enum.PRESENTATION_RECEIVED,
+            to,
+            from,
+            message: getNotificationMessage('presentationReceived', resolveRecipientLocale(to), {
+                from: from.displayName,
+            }),
+            data: { vpUris: [uri] },
+        });
+    }
 
     return uri;
 };
@@ -63,16 +69,17 @@ export const acceptPresentation = async (profile: ProfileType, uri: string): Pro
         });
     }
 
-    // Check if presentation has already been received by this profile
+    // Acceptance is idempotent so a client can safely recover from a response
+    // interruption without producing a second received relationship.
     const alreadyReceived = await getPresentationReceivedByProfile(id, profile);
-    if (alreadyReceived) {
-        throw new TRPCError({
-            code: 'BAD_REQUEST',
-            message: 'Presentation has already been received',
-        });
+    if (!alreadyReceived) {
+        await createReceivedPresentationRelationship(
+            profile,
+            pendingVp.source,
+            pendingVp.target,
+            pendingVp.relationship.metadata
+        );
     }
 
-    await createReceivedPresentationRelationship(profile, pendingVp.source, pendingVp.target);
-
     return true;
 };

package/src/helpers/profile.helpers.ts

@@ -1,3 +1,5 @@
+import { LCNProfileValidator } from '@learncard/types';
+
 import { getProfileByProfileId } from '@accesslayer/profile/read';
 import { createProfile } from '@accesslayer/profile/create';
 import { getProfileIdFromDid } from './did.helpers';
@@ -6,6 +8,11 @@ import { ProfileType } from 'types/profile';
 export const transformProfileId = (rawInput: string): string =>
     rawInput.toLowerCase().replaceAll(':', '%3A');
 
+export const PublicProfileIdValidator = LCNProfileValidator.shape.profileId.refine(
+    profileId => !transformProfileId(profileId).startsWith('sample-'),
+    { message: 'Profile IDs beginning with "sample-" are reserved.' }
+);
+
 /**
  * Gets or creates a federated profile for cross-instance credential sending.
  * Federated profiles use email-like format: profileId@service-domain to avoid collisions.

package/src/helpers/rateLimit.helpers.ts

@@ -24,7 +24,7 @@ export type RateLimitWindow = {
 };
 
 /**
- * Consume one unit against each window, in order, and throw once any is
+ * Consume the requested units against each window, in order, and throw once any is
  * exhausted.
  *
  * Fails CLOSED: if the cache is unavailable, `cache.incr` returns `undefined`
@@ -48,11 +48,8 @@ export const enforceRateLimits = async (windows: RateLimitWindow[]): Promise<voi
         }
 
         if (count > limit) {
-            // tRPC has no native 429; the existing convention in this service is
-            // to cast to BAD_REQUEST while keeping the semantic code, so clients
-            // can still discriminate on it.
             throw new TRPCError({
-                code: 'TOO_MANY_REQUESTS' as 'BAD_REQUEST',
+                code: 'TOO_MANY_REQUESTS',
                 message: `Rate limit exceeded: ${description}`,
             });
         }