@learncard/network-brain-service 3.18.0 → 3.19.1

package/src/helpers/share-link-owner/diagnostics.ts

@@ -0,0 +1,89 @@
+/**
+ * Bounded, sanitized diagnostics for share-link service composition.
+ *
+ * The owner and public APIs fail closed for two states that are otherwise
+ * indistinguishable to an operator:
+ *
+ * - intentionally absent configuration (`status: 'disabled'`) is silent and
+ *   inert; it is a supported deployment;
+ * - malformed/partial service wiring (`status: 'invalid'`) or a failed
+ *   dependency build emits one fixed category so a misconfiguration is
+ *   distinguishable from an unconfigured deployment.
+ *
+ * The reporter is bounded per process: each category is emitted at most once,
+ * so a flood of requests against a misconfigured deployment cannot flood logs.
+ * The event carries only a fixed allowlisted category string: never an
+ * environment value, URL, request body, DID key, title, note or ciphertext.
+ */
+
+export const SHARE_LINK_COMPOSITION_DIAGNOSTIC = {
+    OWNER_CONFIGURATION_INVALID: 'share_link_owner_configuration_invalid',
+    OWNER_INITIALIZATION_FAILED: 'share_link_owner_initialization_failed',
+    PUBLIC_CONFIGURATION_INVALID: 'share_link_public_configuration_invalid',
+    PUBLIC_INITIALIZATION_FAILED: 'share_link_public_initialization_failed',
+} as const;
+
+export type ShareLinkCompositionDiagnosticCategory =
+    (typeof SHARE_LINK_COMPOSITION_DIAGNOSTIC)[keyof typeof SHARE_LINK_COMPOSITION_DIAGNOSTIC];
+
+export type ShareLinkDiagnosticSink = (category: ShareLinkCompositionDiagnosticCategory) => void;
+
+/** Aggregate-only sink matching the existing route reporting convention. */
+export const defaultShareLinkDiagnosticSink: ShareLinkDiagnosticSink = category => {
+    console.warn('share_link_composition_diagnostic', { category });
+};
+
+/** Wrap a sink so each category is emitted at most once per process. */
+export const createBoundedShareLinkDiagnosticReporter = (
+    sink: ShareLinkDiagnosticSink = defaultShareLinkDiagnosticSink
+): ShareLinkDiagnosticSink => {
+    const reported = new Set<ShareLinkCompositionDiagnosticCategory>();
+
+    return category => {
+        if (reported.has(category)) return;
+        reported.add(category);
+        sink(category);
+    };
+};
+
+type ShareLinkConfigStatus = { status: 'disabled' } | { status: 'invalid' } | { status: 'enabled' };
+
+/**
+ * Compose the lazy getter a share-link router uses around a pure config
+ * resolution and a retryable initializer.
+ *
+ * Disabled configuration returns `null` silently. Invalid configuration reports
+ * a single sanitized diagnostic and returns `null`, preserving the anonymous
+ * not_found behavior. An enabled but failing build reports a single sanitized
+ * diagnostic and rethrows so the caller maps it to a generic error while the
+ * retryable initializer clears the failed attempt cache.
+ */
+export const createShareLinkDependencyResolver = <TDependencies>(options: {
+    readonly resolveConfig: () => ShareLinkConfigStatus;
+    readonly initializeDependencies: () => Promise<TDependencies>;
+    readonly reportDiagnostic: ShareLinkDiagnosticSink;
+    readonly configurationInvalidCategory: ShareLinkCompositionDiagnosticCategory;
+    readonly initializationFailedCategory: ShareLinkCompositionDiagnosticCategory;
+}): (() => Promise<TDependencies | null>) => {
+    return async () => {
+        const config = options.resolveConfig();
+
+        // Intentionally absent configuration: inert and silent.
+        if (config.status === 'disabled') return null;
+
+        // Malformed/partial wiring: one bounded diagnostic, still fail closed.
+        if (config.status === 'invalid') {
+            options.reportDiagnostic(options.configurationInvalidCategory);
+            return null;
+        }
+
+        try {
+            return await options.initializeDependencies();
+        } catch (error) {
+            // The initializer has already cleared its failed attempt; report the
+            // category once and let the caller surface a sanitized error.
+            options.reportDiagnostic(options.initializationFailedCategory);
+            throw error;
+        }
+    };
+};

package/src/helpers/share-link-owner/lazy-initializer.ts

@@ -0,0 +1,29 @@
+/**
+ * Retryable lazy initialization for the owner share-link runtime.
+ *
+ * Successful and in-flight builds are shared across concurrent callers. A
+ * *failed* build must never be cached: a transient constraint/graph/signer
+ * failure would otherwise poison the owner API until the process restarts
+ * (the same defect previously corrected for the C7 setup cache). Only the
+ * failed attempt is cleared, so a later request retries while any other
+ * in-flight attempt keeps its own shared promise.
+ */
+export const createRetryableLazyInitializer = <T>(build: () => Promise<T>): (() => Promise<T>) => {
+    let cached: Promise<T> | null = null;
+
+    return () => {
+        if (cached) return cached;
+
+        const attempt = build();
+        cached = attempt;
+
+        // Preserve the rejection for the awaiting caller, but detach it from the
+        // cache so the next call rebuilds. `catch` also prevents an unhandled
+        // rejection when nobody is awaiting this particular attempt.
+        attempt.catch(() => {
+            if (cached === attempt) cached = null;
+        });
+
+        return attempt;
+    };
+};

package/src/helpers/share-link-owner-projection.ts

@@ -0,0 +1,52 @@
+import type { ShareLink } from '@learncard/types';
+
+import type { ShareLinkRecord } from '../models/ShareLink';
+
+/**
+ * Explicit owner projection of a `ShareLinkRecord`.
+ *
+ * This is a deliberate field-by-field mapping, never a spread: the raw record
+ * carries internal object refs, operation ids, leases, hashes, byte counts and
+ * ciphertext bindings that must never reach a caller. `contentUrl` is
+ * intentionally omitted here — the public resolve/content routes own the guarded
+ * relative URL, and a LearnCloud object URL (or a fabricated decryption key)
+ * must never be exposed.
+ *
+ * `viewCountingEnabled` is the FRESHLY re-resolved authoritative eligibility for
+ * the owner (never the stale `minorPolicyViewCountingEnabled` snapshot alone and
+ * never a caller field). When it is not exactly `true`, `viewCount` is omitted
+ * and `lastViewedAt` is nulled so a formerly eligible owner's historical counts
+ * stop leaking through get/mutation/status/retry.
+ */
+export const toOwnerShareLink = (
+    record: ShareLinkRecord,
+    viewCountingEnabled?: boolean
+): ShareLink => {
+    const countingEnabled = viewCountingEnabled === true;
+
+    return {
+        id: record.id,
+        title: record.title,
+        ...(record.note === null ? {} : { note: record.note }),
+        selectedCount: record.selectedCount,
+        version: record.version,
+        contentVersion: record.contentVersion,
+        status: record.status,
+        contentState: record.contentState,
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+        expiresAt: record.expiresAt,
+        stoppedAt: record.stoppedAt,
+        ...(countingEnabled
+            ? { lastViewedAt: record.lastViewedAt, viewCount: record.viewCount }
+            : { lastViewedAt: null }),
+        passcodeProtected: record.passcodeHash != null,
+        notifyOnView: record.notifyOnView === true,
+        minorPolicy: {
+            isMinor: record.minorPolicyIsMinor,
+            policyResolved: record.minorPolicyResolved,
+            defaultExpiryDays: record.minorPolicyDefaultExpiryDays === 365 ? 365 : 30,
+            viewCountingEnabled: record.minorPolicyViewCountingEnabled,
+        },
+    };
+};

package/src/helpers/share-link-passcode-abuse.ts

@@ -0,0 +1,36 @@
+import cache from '@cache';
+import { environment } from '@environment';
+
+// The short shared window limits distributed guessing while bounding the time
+// an attacker can deny access to a legitimate recipient. Per-source limits
+// preserve capacity for other recipients until the shared budget is exhausted.
+const WINDOW_SECONDS = 60;
+// A successful recipient view checks the passcode at resolve and content, so
+// it spends two attempts. Keep that in mind before lowering these budgets.
+const SHARE_ATTEMPT_LIMIT = 24;
+const SOURCE_ATTEMPT_LIMIT = 6;
+
+const keys = (namespace: string, shareId: string, sourceIp?: string): [string, string] => [
+    `share-link-passcode-attempt:${namespace}:${shareId}`,
+    `share-link-passcode-attempt-source:${namespace}:${shareId}:${sourceIp ?? 'unknown'}`,
+];
+
+export const reserveSharePasscodeAttempt = async (
+    namespace: string,
+    shareId: string,
+    sourceIp?: string
+): Promise<boolean> => {
+    // Process-local fallback counters cannot stop rotated-IP guesses across
+    // production workers. Protected access requires the shared Redis counter.
+    if (environment.NODE_ENV === 'production' && !cache.redis) return false;
+    const [shareKey, sourceKey] = keys(namespace, shareId, sourceIp);
+    // Reserve before Argon2. Redis INCR is atomic across Lambda instances, so
+    // simultaneous guesses cannot all read a stale budget. Count successful
+    // attempts too; no cross-key refund race and no stored submitted value.
+    const sourceCount = await cache.incr(sourceKey, WINDOW_SECONDS);
+    if (sourceCount === undefined || sourceCount > SOURCE_ATTEMPT_LIMIT) return false;
+    // Rejected requests from this source never consume another recipient's
+    // share-wide budget. Both reservations still precede Argon2.
+    const shareCount = await cache.incr(shareKey, WINDOW_SECONDS);
+    return shareCount !== undefined && shareCount <= SHARE_ATTEMPT_LIMIT;
+};

package/src/helpers/share-link-passcode.ts

@@ -0,0 +1,47 @@
+import { randomBytes } from 'node:crypto';
+
+import { argon2id, argon2Verify } from 'hash-wasm';
+
+const ARGON2_MEMORY_KIB = 19_456;
+const ARGON2_ITERATIONS = 2;
+const ARGON2_PARALLELISM = 1;
+const ARGON2_HASH_BYTES = 32;
+const MAX_CONCURRENT_VERIFICATIONS = 4;
+let activeVerifications = 0;
+
+export class SharePasscodeCapacityError extends Error {
+    constructor() {
+        super('share passcode verification capacity exhausted');
+        this.name = 'SharePasscodeCapacityError';
+    }
+}
+
+/** Hash a share passcode as an Argon2id PHC string with a fresh 128-bit salt. */
+export const hashSharePasscode = async (passcode: string): Promise<string> =>
+    argon2id({
+        password: passcode,
+        salt: randomBytes(16),
+        iterations: ARGON2_ITERATIONS,
+        memorySize: ARGON2_MEMORY_KIB,
+        parallelism: ARGON2_PARALLELISM,
+        hashLength: ARGON2_HASH_BYTES,
+        outputType: 'encoded',
+    });
+
+/** Verify without ever logging, returning, or persisting the plaintext passcode. */
+export const verifySharePasscode = async (
+    passcodeHash: string,
+    passcode: string
+): Promise<boolean> => {
+    // Local defense for long-lived workers; Lambda's cross-instance budget is
+    // reserved in Redis before this function runs. Capacity is not a wrong code.
+    if (activeVerifications >= MAX_CONCURRENT_VERIFICATIONS) throw new SharePasscodeCapacityError();
+    activeVerifications += 1;
+    try {
+        return await argon2Verify({ password: passcode, hash: passcodeHash });
+    } catch {
+        return false;
+    } finally {
+        activeVerifications -= 1;
+    }
+};

package/src/helpers/share-link-policy/index.ts

@@ -0,0 +1,7 @@
+export * from './types';
+export {
+    composeShareLinkPolicy,
+    createShareLinkPolicyResolver,
+    resolveShareLinkExpiry,
+} from './resolver';
+export { createProductionShareLinkPolicySource } from './production';

package/src/helpers/share-link-policy/production.ts

@@ -0,0 +1,88 @@
+import { getProfileByProfileId } from '@accesslayer/profile/read';
+import { isProfileManaged } from '@accesslayer/profile/relationships/read';
+import type { ShareViewEligibilitySource } from '@accesslayer/share-link/types';
+import type { ShareLinkTransaction } from '@accesslayer/share-link/transaction';
+import { transformProfileId } from '@helpers/profile.helpers';
+
+import { composeShareLinkPolicy } from './resolver';
+import type { ShareLinkOwnerAge, ShareLinkPolicySnapshot, ShareLinkPolicySource } from './types';
+
+const ADULT_AGE = 18;
+
+/** A missing or malformed birthdate never grants view tracking. */
+export const ageFromPersistedProfile = (
+    profile: { dob?: unknown; type?: unknown } | null,
+    now: Date = new Date()
+): ShareLinkOwnerAge => {
+    if (!profile) return 'unknown';
+    if (profile.type === 'child') return 'minor';
+    if (typeof profile.dob !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(profile.dob)) {
+        return 'unknown';
+    }
+
+    const year = Number(profile.dob.slice(0, 4));
+    const month = Number(profile.dob.slice(5, 7));
+    const day = Number(profile.dob.slice(8, 10));
+    const birthday = new Date(Date.UTC(year, month - 1, day));
+    if (
+        birthday.getUTCFullYear() !== year ||
+        birthday.getUTCMonth() !== month - 1 ||
+        birthday.getUTCDate() !== day ||
+        birthday.getTime() > now.getTime()
+    ) {
+        return 'unknown';
+    }
+
+    const age =
+        now.getUTCFullYear() -
+        year -
+        (now.getUTCMonth() + 1 < month ||
+        (now.getUTCMonth() + 1 === month && now.getUTCDate() < day)
+            ? 1
+            : 0);
+
+    return age >= ADULT_AGE ? 'adult' : 'minor';
+};
+
+/**
+ * Profile birthdate is persisted server-side, but self-reported rather than
+ * independently verified. Unknown dates and child profiles stay restricted.
+ */
+export const createProductionShareLinkPolicySource = (options?: {
+    resolveOwnerAge?: (profileId: string) => Promise<ShareLinkOwnerAge>;
+}): ShareLinkPolicySource => ({
+    resolveOwnerAge:
+        options?.resolveOwnerAge ??
+        (async profileId => ageFromPersistedProfile(await getProfileByProfileId(profileId))),
+    isManaged: isProfileManaged,
+});
+
+/** Read current eligibility within the share lock; no request values or network I/O. */
+export const resolveCurrentShareLinkPolicy = async (
+    tx: ShareLinkTransaction,
+    ownerProfileId: string,
+    now: Date
+): Promise<ShareLinkPolicySnapshot> => {
+    const result = await tx.run(
+        `MATCH (p:Profile {profileId: $profileId})
+         OPTIONAL MATCH (p)-[:MANAGED_BY]->(directManager:Profile)
+         OPTIONAL MATCH (manager:ProfileManager)-[:MANAGES]->(p)
+         RETURN p.dob AS dob, p.type AS profileType,
+                (directManager IS NOT NULL OR manager IS NOT NULL) AS isManaged
+         LIMIT 1`,
+        { profileId: transformProfileId(ownerProfileId) }
+    );
+    const record = result.records[0];
+    if (!record) return composeShareLinkPolicy('unknown', true);
+
+    return composeShareLinkPolicy(
+        ageFromPersistedProfile({ dob: record.get('dob'), type: record.get('profileType') }, now),
+        record.get('isManaged') !== false
+    );
+};
+
+export const productionShareViewEligibilitySource: ShareViewEligibilitySource = {
+    isEligible: async (tx, input) =>
+        (await resolveCurrentShareLinkPolicy(tx, input.ownerProfileId, input.now))
+            .viewCountingEnabled,
+};

package/src/helpers/share-link-policy/resolver.ts

@@ -0,0 +1,108 @@
+import { DEFAULT_SHARE_LINK_POLICY } from './types';
+import type {
+    ShareLinkOwnerAge,
+    ShareLinkPolicyResolver,
+    ShareLinkPolicySnapshot,
+    ShareLinkPolicySource,
+} from './types';
+
+/**
+ * Pure policy decision table.
+ *
+ * - known minor, managed or unknown age => no views, 30 days
+ * - known unmanaged adult => views enabled, 365 days
+ *
+ */
+export const composeShareLinkPolicy = (
+    age: ShareLinkOwnerAge,
+    isManaged: boolean
+): ShareLinkPolicySnapshot => {
+    const isMinor = age === 'minor' ? true : age === 'adult' ? false : null;
+    const policyResolved = age !== 'unknown';
+    const isUnmanagedAdult = age === 'adult' && !isManaged;
+
+    return {
+        isMinor,
+        policyResolved,
+        defaultExpiryDays: isUnmanagedAdult ? 365 : 30,
+        viewCountingEnabled: isUnmanagedAdult,
+    };
+};
+
+/**
+ * Build an injectable resolver over an authoritative source. Any source failure
+ * fails closed to the conservative default rather than assuming adult.
+ */
+export const createShareLinkPolicyResolver = (
+    source: ShareLinkPolicySource
+): ShareLinkPolicyResolver => ({
+    resolve: async (profileId: string): Promise<ShareLinkPolicySnapshot> => {
+        try {
+            const [age, isManaged] = await Promise.all([
+                source.resolveOwnerAge(profileId),
+                source.isManaged(profileId),
+            ]);
+
+            return composeShareLinkPolicy(age, isManaged);
+        } catch {
+            return DEFAULT_SHARE_LINK_POLICY;
+        }
+    },
+});
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * Effective expiry: an explicit caller value (including explicit `null`) is
+ * preserved; only an omitted value receives the policy default. The default is
+ * derived from the policy at first reservation and then persisted, so a retry on
+ * a later clock replays the original value.
+ */
+export const resolveShareLinkExpiry = (
+    policy: ShareLinkPolicySnapshot,
+    expiresAt: string | null | undefined,
+    now: Date
+): string | null => {
+    if (expiresAt !== undefined) return expiresAt;
+
+    return new Date(now.getTime() + policy.defaultExpiryDays * DAY_MS).toISOString();
+};
+
+/**
+ * Conservatively merge a share's currently committed policy with the policy a
+ * reservation intends to apply at finalization.
+ *
+ * A reservation can be created before the owner's authoritative policy changes
+ * and then finalized later by a replay or a recovery worker. Applying the stale
+ * reservation policy verbatim could re-enable view counting for an owner who has
+ * since become managed/minor. The merge therefore only ever tightens:
+ *
+ * - view counting stays enabled only if BOTH policies allow it;
+ * - a known minor on either side is a minor, an unknown on either side is
+ *   unknown (never inferred adult);
+ * - the default expiry is the shorter of the two.
+ *
+ * Production finalization also rechecks current graph policy under the share
+ * lock before an explicit update can replace an old unknown snapshot.
+ */
+export const mergeShareLinkPolicyConservatively = (
+    current: ShareLinkPolicySnapshot,
+    incoming: ShareLinkPolicySnapshot
+): ShareLinkPolicySnapshot => {
+    const isMinor =
+        current.isMinor === true || incoming.isMinor === true
+            ? true
+            : current.isMinor === false && incoming.isMinor === false
+              ? false
+              : null;
+
+    return {
+        isMinor,
+        policyResolved: current.policyResolved && incoming.policyResolved,
+        defaultExpiryDays:
+            current.defaultExpiryDays <= incoming.defaultExpiryDays
+                ? current.defaultExpiryDays
+                : incoming.defaultExpiryDays,
+        viewCountingEnabled: current.viewCountingEnabled && incoming.viewCountingEnabled,
+    };
+};

package/src/helpers/share-link-policy/types.ts

@@ -0,0 +1,48 @@
+/**
+ * LC-2187 owner share-link policy types.
+ *
+ * Policy is always derived server-side from trusted persisted state; nothing in
+ * this module reads the request body. The conservative default (unknown age,
+ * 30-day expiry, no view counting) is what an unavailable or untrustworthy age
+ * source produces — absence of a manager is NOT evidence of adulthood.
+ */
+
+/** Result of consulting the authoritative server-side age source. */
+export type ShareLinkOwnerAge = 'adult' | 'minor' | 'unknown';
+
+/** Immutable policy snapshot persisted with the share under the write lock. */
+export type ShareLinkPolicySnapshot = {
+    /** `true` known minor, `false` known adult, `null` unknown. */
+    isMinor: boolean | null;
+    /** `true` only when the age source returned a known adult/minor value. */
+    policyResolved: boolean;
+    defaultExpiryDays: 30 | 365;
+    viewCountingEnabled: boolean;
+};
+
+/**
+ * Authoritative server-side sources. Implementations must read persisted server
+ * state only; no request-derived value may be used as authority.
+ */
+export type ShareLinkPolicySource = {
+    /**
+     * Resolve the owner's age. `unknown` is required when no trustworthy source
+     * exists; it must never be inferred from the absence of a manager.
+     */
+    resolveOwnerAge: (profileId: string) => Promise<ShareLinkOwnerAge>;
+    /** Whether the profile is currently managed by another profile. */
+    isManaged: (profileId: string) => Promise<boolean>;
+};
+
+/** Injectable server-side policy resolver used by the coordinator. */
+export type ShareLinkPolicyResolver = {
+    resolve: (profileId: string) => Promise<ShareLinkPolicySnapshot>;
+};
+
+/** Fail-closed policy: no views, 30 days, age unknown. */
+export const DEFAULT_SHARE_LINK_POLICY: ShareLinkPolicySnapshot = Object.freeze({
+    isMinor: null,
+    policyResolved: false,
+    defaultExpiryDays: 30,
+    viewCountingEnabled: false,
+});

package/src/helpers/share-link-public/config.ts

@@ -0,0 +1,41 @@
+import {
+    hasShareLinkServiceTransportConfig,
+    resolveShareLinkServiceTransportConfig,
+} from '../share-link-maintenance/config';
+
+/**
+ * Available automatically once trusted service configuration is complete.
+ * Namespace, origin and audience come only from server configuration. Missing
+ * wiring is inactive; partial or invalid wiring fails closed.
+ */
+
+export type ShareLinkPublicApiConfigResolution =
+    | { status: 'disabled' }
+    | { status: 'invalid' }
+    | {
+          status: 'enabled';
+          namespace: string;
+          origin: string;
+          audience: string;
+          allowInsecureLoopback: boolean;
+      };
+
+export const resolveShareLinkPublicApiConfig = (
+    raw: unknown
+): ShareLinkPublicApiConfigResolution => {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) return { status: 'invalid' };
+
+    const source = raw as Record<string, unknown>;
+    if (!hasShareLinkServiceTransportConfig(source)) return { status: 'disabled' };
+
+    const transport = resolveShareLinkServiceTransportConfig(source);
+    if (transport.status !== 'enabled') return { status: 'invalid' };
+
+    return {
+        status: 'enabled',
+        namespace: transport.config.namespace,
+        origin: transport.config.origin,
+        audience: transport.config.audience,
+        allowInsecureLoopback: transport.config.allowInsecureLoopback,
+    };
+};

package/src/helpers/share-link-view-notification.ts

@@ -0,0 +1,18 @@
+import cache from '@cache';
+import { environment } from '@environment';
+
+const WINDOW_SECONDS = 10 * 60;
+
+/** One owner alert per share per window, claimed atomically across Brain workers. */
+export const claimShareViewNotification = async (
+    namespace: string,
+    shareId: string
+): Promise<boolean> => {
+    if (environment.NODE_ENV === 'production' && !cache.redis) return false;
+    const count = await cache.incr(
+        `share-link-view-notification:${namespace}:${shareId}`,
+        WINDOW_SECONDS
+    );
+    // A cache failure suppresses alerts, never privacy enforcement or view counts.
+    return count === 1;
+};

package/src/helpers/shim.ts

@@ -5,6 +5,7 @@ import {
     type Context as AWSContext,
 } from 'aws-lambda';
 import { TRPCError } from '@trpc/server';
+import { withInboxBatchBodyLimit } from './inbox-batch-http.helpers';
 import { type IncomingMessage, type ServerResponse } from 'http';
 
 import { OpenApiRouter } from 'trpc-to-openapi';
@@ -183,36 +184,36 @@ export const createOpenApiAwsLambdaHandler = <TRouter extends OpenApiRouter>(
         maxBodySize: undefined, // AWS Lambda handles body size limits
     });
 
-    return async (
-        event: AWSAPIGatewayEvent,
-        _context: AWSContext
-    ): Promise<APIGatewayProxyResult> => {
-        try {
-            const req = createRequestFromEvent(event);
-            const { res, promise } = createResponseHandler();
-
-            // Execute the handler
-            await openApiHttpHandler(req, res);
-
-            return await promise;
-        } catch (cause) {
-            // Handle any uncaught errors
-            const error = cause instanceof Error ? cause : new Error('Unknown error');
-            const statusCode =
-                error instanceof TRPCError ? (error.code === 'NOT_FOUND' ? 404 : 500) : 500;
-
-            return {
-                statusCode,
-                headers: {
-                    'Content-Type': 'application/json',
-                },
-                body: JSON.stringify({
-                    error: {
-                        message: error.message || 'Internal server error',
-                        code: error instanceof TRPCError ? error.code : 'INTERNAL_SERVER_ERROR',
+    return withInboxBatchBodyLimit(
+        async (event: AWSAPIGatewayEvent, _context: AWSContext): Promise<APIGatewayProxyResult> => {
+            try {
+                const req = createRequestFromEvent(event);
+                const { res, promise } = createResponseHandler();
+
+                // Execute the handler
+                await openApiHttpHandler(req, res);
+
+                return await promise;
+            } catch (cause) {
+                // Handle any uncaught errors
+                const error = cause instanceof Error ? cause : new Error('Unknown error');
+                const statusCode =
+                    error instanceof TRPCError ? (error.code === 'NOT_FOUND' ? 404 : 500) : 500;
+
+                return {
+                    statusCode,
+                    headers: {
+                        'Content-Type': 'application/json',
                     },
-                }),
-            } satisfies APIGatewayProxyResult;
-        }
-    };
+                    body: JSON.stringify({
+                        error: {
+                            message: error.message || 'Internal server error',
+                            code: error instanceof TRPCError ? error.code : 'INTERNAL_SERVER_ERROR',
+                        },
+                    }),
+                } satisfies APIGatewayProxyResult;
+            }
+        },
+        'openapi'
+    );
 };