@learncard/network-brain-service 3.19.0 → 3.19.1

package/src/models/ShareLink.ts

@@ -0,0 +1,130 @@
+import { ModelFactory, NeogmaInstance } from 'neogma';
+
+import { neogma } from '@instance';
+
+/** Lifecycle status of a share. Only `active` is ever served to a recipient. */
+export type ShareLinkStatus = 'pending' | 'active' | 'stopped';
+
+/**
+ * Whether the visible content pointer for a share is committed.
+ *
+ * `staging` means a reservation exists but the object is not visible yet;
+ * `content_missing` means Brain believes content should be visible but LearnCloud
+ * does not have it, so the share fails closed and is never served.
+ */
+export type ShareContentState = 'staging' | 'finalized' | 'content_missing';
+
+/**
+ * Persisted ShareLink metadata (LC-2187).
+ *
+ * This node is the only Brain-side source of truth for the *visible* content
+ * pointer. It stores an opaque immutable `activeObjectRef` plus content/recovery
+ * hashes and byte counts — never ciphertext, a raw private source URI or a key.
+ * The concrete encrypted envelope and owner recovery JWE live together in the
+ * dedicated LearnCloud collection keyed by the immutable object reference.
+ *
+ * `version` is the committed record revision used for optimistic concurrency; a
+ * reservation (`staging`) does not change it. `contentVersion` is the visible
+ * content revision and changes only when a replacement is finalized.
+ */
+export type ShareLinkRecord = {
+    id: string;
+    namespace: string;
+    ownerProfileId: string;
+    version: number;
+    contentVersion: number;
+    /**
+     * Monotonic fence. Bumped on every reservation and on revoke; a worker may
+     * only finalize the reservation whose generation still equals this value.
+     */
+    generation: number;
+    status: ShareLinkStatus;
+    contentState: ShareContentState;
+    activeObjectRef: string | null;
+    activeObjectOperationId: string | null;
+    activeContentHash: string | null;
+    activeContentBytes: number | null;
+    activeRecoveryHash: string | null;
+    /** Operation binding: the operation id that produced the visible revision. */
+    lastOperationId: string | null;
+    /** Operation binding: the create request that first bound this share id. */
+    createdByClientRequestId: string | null;
+    title: string;
+    note: string | null;
+    selectedCount: number;
+    expiresAt: string | null;
+    stoppedAt: string | null;
+    viewCount: number;
+    lastViewedAt: string | null;
+    /** Argon2id PHC string. Plaintext passcodes are never persisted. */
+    passcodeHash?: string | null;
+    notifyOnView?: boolean;
+    minorPolicyIsMinor: boolean | null;
+    minorPolicyResolved: boolean;
+    minorPolicyDefaultExpiryDays: number;
+    minorPolicyViewCountingEnabled: boolean;
+    createdAt: string;
+    updatedAt: string;
+};
+
+/** Neo4j omits null properties; the repository maps missing values back to null. */
+type ShareLinkProperties = { lockTick?: number } & {
+    [Key in keyof ShareLinkRecord]:
+        | Exclude<ShareLinkRecord[Key], null>
+        | (null extends ShareLinkRecord[Key] ? undefined : never);
+};
+export type ShareLinkInstance = NeogmaInstance<ShareLinkProperties, Record<string, never>>;
+
+/**
+ * `:ShareLink` model registration. The repository writes this label with raw
+ * parameterized Cypher so it can hold the share write lock across read + write
+ * within one transaction; the model exists for schema/typed instance support and
+ * constraint registration.
+ */
+export const ShareLink = ModelFactory<ShareLinkProperties, Record<string, never>>(
+    {
+        label: 'ShareLink',
+        schema: {
+            id: { type: 'string', required: true },
+            namespace: { type: 'string', required: true },
+            ownerProfileId: { type: 'string', required: true },
+            version: { type: 'number', required: true },
+            contentVersion: { type: 'number', required: true },
+            generation: { type: 'number', required: true },
+            status: { type: 'string', required: true, enum: ['pending', 'active', 'stopped'] },
+            contentState: {
+                type: 'string',
+                required: true,
+                enum: ['staging', 'finalized', 'content_missing'],
+            },
+            activeObjectRef: { type: 'string', required: false },
+            activeObjectOperationId: { type: 'string', required: false },
+            activeContentHash: { type: 'string', required: false },
+            activeContentBytes: { type: 'number', required: false },
+            activeRecoveryHash: { type: 'string', required: false },
+            lastOperationId: { type: 'string', required: false },
+            createdByClientRequestId: { type: 'string', required: false },
+            title: { type: 'string', required: true },
+            note: { type: 'string', required: false },
+            selectedCount: { type: 'number', required: true },
+            expiresAt: { type: 'string', required: false },
+            stoppedAt: { type: 'string', required: false },
+            viewCount: { type: 'number', required: true },
+            lastViewedAt: { type: 'string', required: false },
+            passcodeHash: { type: 'string', required: false },
+            // LC-2187 records created before opt-in alerts may omit this field.
+            notifyOnView: { type: 'boolean', required: false },
+            minorPolicyIsMinor: { type: 'boolean', required: false },
+            minorPolicyResolved: { type: 'boolean', required: true },
+            minorPolicyDefaultExpiryDays: { type: 'number', required: true },
+            minorPolicyViewCountingEnabled: { type: 'boolean', required: true },
+            createdAt: { type: 'string', required: true },
+            updatedAt: { type: 'string', required: true },
+            lockTick: { type: 'number', required: false },
+        },
+        primaryKeyField: 'id',
+    },
+    neogma
+);
+
+export default ShareLink;

package/src/models/ShareViewReceipt.ts

@@ -0,0 +1,69 @@
+import { ModelFactory, NeogmaInstance } from 'neogma';
+
+import { neogma } from '@instance';
+
+/**
+ * Persisted, short-lived view receipt (LC-2187 ADR-10).
+ *
+ * Only the hash of the opaque CSPRNG token is stored — never the token, a viewer
+ * identity, an IP, a fingerprint, a credential, a key or any request body. The
+ * node is bound to one immutable committed tuple
+ * `(namespace, ownerProfileId, shareId, contentVersion, objectRef, operationId)`
+ * so a receipt for a superseded revision can never count toward the current one.
+ *
+ * `consumedAt` is the single-use marker; `lockTick` exists only so a transaction
+ * can take a write lock on the receipt AFTER it holds the share write lock.
+ * `expiresAt` bounds retention and is indexed for one-shot pruning.
+ */
+export type ShareViewReceiptRecord = {
+    receiptHash: string;
+    namespace: string;
+    ownerProfileId: string;
+    shareId: string;
+    contentVersion: number;
+    objectRef: string;
+    operationId: string;
+    createdAt: string;
+    expiresAt: string;
+    consumedAt: string | null;
+};
+
+type ShareViewReceiptProperties = { lockTick?: number } & {
+    [Key in keyof ShareViewReceiptRecord]:
+        | Exclude<ShareViewReceiptRecord[Key], null>
+        | (null extends ShareViewReceiptRecord[Key] ? undefined : never);
+};
+
+export type ShareViewReceiptInstance = NeogmaInstance<
+    ShareViewReceiptProperties,
+    Record<string, never>
+>;
+
+/**
+ * `:ShareViewReceipt` model registration. The repository writes this label with
+ * raw parameterized Cypher so consume + increment happen in one transaction with
+ * explicit share-then-receipt lock ordering; the model exists for schema and
+ * constraint registration.
+ */
+export const ShareViewReceipt = ModelFactory<ShareViewReceiptProperties, Record<string, never>>(
+    {
+        label: 'ShareViewReceipt',
+        schema: {
+            receiptHash: { type: 'string', required: true },
+            namespace: { type: 'string', required: true },
+            ownerProfileId: { type: 'string', required: true },
+            shareId: { type: 'string', required: true },
+            contentVersion: { type: 'number', required: true },
+            objectRef: { type: 'string', required: true },
+            operationId: { type: 'string', required: true },
+            createdAt: { type: 'string', required: true },
+            expiresAt: { type: 'string', required: true },
+            consumedAt: { type: 'string', required: false },
+            lockTick: { type: 'number', required: false },
+        },
+        primaryKeyField: 'receiptHash',
+    },
+    neogma
+);
+
+export default ShareViewReceipt;

package/src/models/index.ts

@@ -69,6 +69,7 @@ Presentation.addRelationships({
         properties: {
             from: { property: 'from', schema: { type: 'string', required: true } },
             date: { property: 'date', schema: { type: 'string', required: true } },
+            metadata: { property: 'metadata', schema: { type: 'object', required: false } },
         },
     },
 });
@@ -256,4 +257,5 @@ export * from './Integration';
 export * from './AppStoreListing';
 export * from './CredentialActivity';
 export * from './CredentialRefresh';
+export * from './ShareLink';
 export * from './StatusList';

package/src/models/share-link-constraints.ts

@@ -0,0 +1,93 @@
+import { neogma } from '@instance';
+
+/**
+ * Uniqueness rules required for the LC-2187 share lifecycle.
+ *
+ * A uniqueness constraint alone does not serialize two transactions consuming one
+ * reservation; the repository additionally holds a `:ShareLink` write lock before
+ * reading status/version/reservation state. These rules are the hard backstop that
+ * makes the resulting race fail closed instead of forking state.
+ */
+const SHARE_LINK_CONSTRAINT_QUERIES = [
+    // A share id is globally unique across namespaces.
+    'CREATE CONSTRAINT share_link_id_unique IF NOT EXISTS FOR (s:ShareLink) REQUIRE (s.id) IS UNIQUE',
+    // One idempotency record per (namespace, owner, operation kind, client request).
+    'CREATE CONSTRAINT share_link_operation_key_unique IF NOT EXISTS FOR (o:ShareLinkOperation) REQUIRE (o.namespace, o.ownerProfileId, o.opKind, o.clientRequestId) IS UNIQUE',
+    // At most one in-flight reservation per share.
+    'CREATE CONSTRAINT share_link_reservation_share_unique IF NOT EXISTS FOR (r:ShareLinkReservation) REQUIRE (r.shareId) IS UNIQUE',
+    // Cleanup is bound to exactly one immutable object reference.
+    'CREATE CONSTRAINT share_content_cleanup_object_unique IF NOT EXISTS FOR (c:ShareContentCleanupJob) REQUIRE (c.objectRef) IS UNIQUE',
+    // One persisted receipt node per opaque token hash (the token itself is never stored).
+    'CREATE CONSTRAINT share_view_receipt_hash_unique IF NOT EXISTS FOR (v:ShareViewReceipt) REQUIRE (v.receiptHash) IS UNIQUE',
+];
+
+/**
+ * Non-unique indexes that keep the lifecycle queries bounded. Index creation is
+ * idempotent and shares the same readiness gate as the constraints.
+ */
+const SHARE_LINK_INDEX_QUERIES = [
+    'CREATE INDEX share_link_ns_owner_idx IF NOT EXISTS FOR (s:ShareLink) ON (s.namespace, s.ownerProfileId)',
+    // Bounded owner-list keyset pagination: filters on the leading
+    // (namespace, ownerProfileId) prefix and orders by the immutable
+    // (createdAt, id) key without a full scan/sort.
+    'CREATE INDEX share_link_ns_owner_created_idx IF NOT EXISTS FOR (s:ShareLink) ON (s.namespace, s.ownerProfileId, s.createdAt, s.id)',
+    'CREATE INDEX share_link_status_idx IF NOT EXISTS FOR (s:ShareLink) ON (s.status)',
+    'CREATE INDEX share_link_operation_operation_id_idx IF NOT EXISTS FOR (o:ShareLinkOperation) ON (o.operationId)',
+    'CREATE INDEX share_link_operation_share_id_idx IF NOT EXISTS FOR (o:ShareLinkOperation) ON (o.shareId)',
+    'CREATE INDEX share_link_reservation_lease_idx IF NOT EXISTS FOR (r:ShareLinkReservation) ON (r.leaseExpiresAt)',
+    // Bounded recovery discovery enumerates expired reservations for one namespace.
+    'CREATE INDEX share_link_reservation_ns_lease_idx IF NOT EXISTS FOR (r:ShareLinkReservation) ON (r.namespace, r.leaseExpiresAt)',
+    'CREATE INDEX share_content_cleanup_due_idx IF NOT EXISTS FOR (c:ShareContentCleanupJob) ON (c.status, c.nextAttemptAt)',
+    // One-shot receipt pruning is bounded by expiry/consumed state.
+    'CREATE INDEX share_view_receipt_expiry_idx IF NOT EXISTS FOR (v:ShareViewReceipt) ON (v.expiresAt)',
+    'CREATE INDEX share_view_receipt_share_idx IF NOT EXISTS FOR (v:ShareViewReceipt) ON (v.namespace, v.shareId)',
+];
+
+type Neo4jSchemaError = {
+    code?: string;
+};
+
+const isEquivalentSchemaRuleRace = (error: unknown): boolean =>
+    (error as Neo4jSchemaError | undefined)?.code ===
+    'Neo.ClientError.Schema.EquivalentSchemaRuleAlreadyExists';
+
+const createShareLinkSchema = async (): Promise<void> => {
+    for (const query of [...SHARE_LINK_CONSTRAINT_QUERIES, ...SHARE_LINK_INDEX_QUERIES]) {
+        try {
+            await neogma.queryRunner.run(query);
+        } catch (error) {
+            // Concurrent service starts can both observe a missing rule before one
+            // wins creation. The losing CREATE is equivalent to the desired ready state.
+            if (!isEquivalentSchemaRuleRace(error)) throw error;
+        }
+    }
+};
+
+let constraintReadiness: Promise<void> | undefined;
+
+/**
+ * Ensures the uniqueness rules and indexes required for the share lifecycle.
+ *
+ * Every public repository method awaits this before its transaction, so a caller
+ * can never observe the "constraints not initialized" window. Concurrent callers
+ * share one attempt; a failed attempt is cleared so a later request can retry
+ * instead of leaving the repository permanently unavailable.
+ */
+export const ensureShareLinkConstraints = (): Promise<void> => {
+    if (!constraintReadiness) {
+        const pendingReadiness = createShareLinkSchema();
+        constraintReadiness = pendingReadiness;
+
+        void pendingReadiness.catch(() => {
+            if (constraintReadiness === pendingReadiness) constraintReadiness = undefined;
+        });
+    }
+
+    return constraintReadiness;
+};
+
+/** Exposed for focused tests that assert the exact schema statements. */
+export const SHARE_LINK_SCHEMA_QUERIES = [
+    ...SHARE_LINK_CONSTRAINT_QUERIES,
+    ...SHARE_LINK_INDEX_QUERIES,
+] as const;

package/src/public-share-link-http.ts

@@ -0,0 +1,49 @@
+import type { FastifyInstance } from 'fastify';
+
+/**
+ * LC-2187 public share-link HTTP adapter seam.
+ *
+ * The Fastify OpenAPI adapter has no `responseMeta` hook, so the no-store
+ * contract for the anonymous public share-link routes is applied at the adapter
+ * boundary itself. This module is deliberately free of the server bootstrap
+ * (which listens on import) so a real Fastify instance can be exercised in
+ * tests without starting the application.
+ */
+
+/**
+ * Prefixes that identify a mounted public share-link OpenAPI request.
+ *
+ * The trpc-to-openapi Fastify adapter rewrites `request.raw.url` by stripping
+ * its `/api` base path before the handler runs, so the `onSend` hook sees
+ * `/public/share-links/...` even though the client requested
+ * `/api/public/share-links/...`. Both forms are matched (with a path-boundary
+ * check) so a sibling route such as `/public/share-links-other` is not treated
+ * as public.
+ */
+const PUBLIC_SHARE_LINK_PREFIXES = ['/api/public/share-links', '/public/share-links'] as const;
+
+/** True for the mounted public share-link OpenAPI route prefix only. */
+export const isPublicShareLinkOpenApiRequestUrl = (url: string | undefined): boolean => {
+    if (!url) return false;
+
+    const path = url.split('?')[0] ?? '';
+
+    return PUBLIC_SHARE_LINK_PREFIXES.some(
+        prefix => path === prefix || path.startsWith(`${prefix}/`)
+    );
+};
+
+/**
+ * Installs the adapter-boundary `Cache-Control: private, no-store` on every
+ * public share-link OpenAPI response, independent of any upstream cache layer.
+ * It is safe to register on any Fastify instance (tRPC-only test apps included).
+ */
+export const registerPublicShareLinkNoStore = (app: FastifyInstance): void => {
+    app.addHook('onSend', async (request, reply, payload) => {
+        if (isPublicShareLinkOpenApiRequestUrl(request.raw.url)) {
+            reply.header('Cache-Control', 'private, no-store');
+        }
+
+        return payload;
+    });
+};

package/src/routes/app-store.ts

@@ -104,6 +104,7 @@ import {
     isDraftBoost,
     appendTemplateEvidenceToCredential,
 } from '@helpers/boost.helpers';
+import { setCredentialSubjectIds } from '@helpers/credentialSubject.helpers';
 import { createBoostForListing } from '@accesslayer/boost/create';
 import { setBoostAsParent } from '@accesslayer/boost/relationships/create';
 import { issueCredentialWithSigningAuthority } from '@helpers/signingAuthority.helpers';
@@ -692,17 +693,7 @@ export const handleSendCredentialEvent = async (
 
         const targetDid = getDidWeb(ctx.domain, target.profileId);
 
-        if (Array.isArray(unsignedVc.credentialSubject)) {
-            unsignedVc.credentialSubject = unsignedVc.credentialSubject.map(subject => ({
-                ...subject,
-                id: targetDid,
-            }));
-        } else {
-            unsignedVc.credentialSubject = {
-                ...unsignedVc.credentialSubject,
-                id: targetDid,
-            };
-        }
+        setCredentialSubjectIds(unsignedVc, targetDid);
 
         if (unsignedVc?.type?.includes('BoostCredential')) {
             unsignedVc.boostId = boostUri;

package/src/routes/boosts.ts

@@ -115,6 +115,7 @@ import {
     prepareCredentialFromBoost,
     appendTemplateEvidenceToCredential,
 } from '@helpers/boost.helpers';
+import { setCredentialSubjectIds } from '@helpers/credentialSubject.helpers';
 import {
     BoostValidator,
     BoostGenerateClaimLinkInput,
@@ -4549,17 +4550,7 @@ export const boostsRouter = t.router({
                 }
                 unsignedVc.issuer = { id: getDidWeb(ctx.domain, profile.profileId) };
 
-                if (Array.isArray(unsignedVc.credentialSubject)) {
-                    unsignedVc.credentialSubject = unsignedVc.credentialSubject.map(subject => ({
-                        ...subject,
-                        id: getDidWeb(ctx.domain, targetProfile.profileId),
-                    }));
-                } else {
-                    unsignedVc.credentialSubject = {
-                        ...unsignedVc.credentialSubject,
-                        id: getDidWeb(ctx.domain, targetProfile.profileId),
-                    };
-                }
+                setCredentialSubjectIds(unsignedVc, getDidWeb(ctx.domain, targetProfile.profileId));
                 if (unsignedVc?.type?.includes('BoostCredential')) unsignedVc.boostId = boostUri;
                 // Inject OBv3 skill alignments based on boost's framework/skills
                 await injectObv3AlignmentsIntoCredentialForBoost(unsignedVc, boost, ctx.domain);

package/src/routes/contracts.ts

@@ -77,6 +77,7 @@ import {
 } from '@accesslayer/consentflowcontract/relationships/create';
 import { getProfileByDid, getProfileByProfileId } from '@accesslayer/profile/read';
 import { sendBoost, isDraftBoost } from '@helpers/boost.helpers';
+import { setCredentialSubjectIds } from '@helpers/credentialSubject.helpers';
 import { isRelationshipBlocked } from '@helpers/connection.helpers';
 import { getBoostByUri } from '@accesslayer/boost/read';
 import { canProfileIssueBoost } from '@accesslayer/boost/relationships/read';
@@ -818,17 +819,7 @@ export const contractsRouter = t.router({
                     unsignedVc.issuanceDate = new Date().toISOString();
                 }
                 unsignedVc.issuer = { id: getDidWeb(ctx.domain, profile.profileId) };
-                if (Array.isArray(unsignedVc.credentialSubject)) {
-                    unsignedVc.credentialSubject = unsignedVc.credentialSubject.map(subject => ({
-                        ...subject,
-                        id: getDidWeb(ctx.domain, otherProfile.profileId),
-                    }));
-                } else {
-                    unsignedVc.credentialSubject = {
-                        ...unsignedVc.credentialSubject,
-                        id: getDidWeb(ctx.domain, otherProfile.profileId),
-                    };
-                }
+                setCredentialSubjectIds(unsignedVc, getDidWeb(ctx.domain, otherProfile.profileId));
                 if (unsignedVc?.type?.includes('BoostCredential')) unsignedVc.boostId = boostUri;
                 // Inject OBv3 skill alignments based on boost's framework/skills
                 await injectObv3AlignmentsIntoCredentialForBoost(unsignedVc, boost, ctx.domain);

package/src/routes/index.ts

@@ -11,6 +11,7 @@ import jwtDecode from 'jwt-decode';
 import * as Sentry from '@sentry/serverless';
 import { ACT_AS_HEADER, AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX } from '@learncard/types';
 import { ContactMethodType } from '@learncard/types';
+import { MAX_SHARE_LINK_REQUEST_BYTES, utf8ByteLength } from '@learncard/types';
 
 import { RegExpTransformer } from '@learncard/helpers';
 import { resolveTenantFromRequest, type ResolvedTenant } from '@learncard/email-templates';
@@ -217,14 +218,93 @@ export const createContext = async (
     return { domain, tenant, _guardianApprovalToken, sourceIp, actAs };
 };
 
-export const openRoute = t.procedure
-    .use(t.middleware(Sentry.Handlers.trpcMiddleware({ attachRpcInput: true }) as any))
-    .use(({ ctx, next, path }) => {
-        Sentry.configureScope(scope => {
-            scope.setTransactionName(`trpc-${path}`);
-        });
-        return next({ ctx });
+const sentryTransactionNameMiddleware = t.middleware(({ ctx, next, path }) => {
+    Sentry.configureScope(scope => {
+        scope.setTransactionName(`trpc-${path}`);
     });
+    return next({ ctx });
+});
+
+// Sentry's tRPC middleware type predates this repo's generic context. Cast
+// through the tRPC builder's expected parameter type instead of `any`.
+type SentryTrpcMiddleware = Parameters<typeof t.middleware>[0];
+
+const sentryInputCaptureMiddleware = Sentry.Handlers.trpcMiddleware({
+    attachRpcInput: true,
+}) as unknown as SentryTrpcMiddleware;
+
+const sentryNoInputCaptureMiddleware = Sentry.Handlers.trpcMiddleware({
+    attachRpcInput: false,
+}) as unknown as SentryTrpcMiddleware;
+
+/**
+ * Complete-request byte bound for owner share-link routes, enforced on the RAW
+ * input before Zod parsing/stripping. Individual field validators cannot bound a
+ * request whose unknown or duplicate fields are stripped first, so this measures
+ * the whole serialized body (UTF-8) and fails closed over the shared 1 MiB cap.
+ *
+ * It is composed into the base so it runs before authentication and before any
+ * input parser, and can never be skipped by a malformed or unauthenticated call.
+ */
+const enforceShareLinkRequestByteBound = t.middleware(async ({ ctx, next, getRawInput }) => {
+    const raw = await getRawInput();
+
+    let bytes: number;
+    if (raw === undefined || raw === null) {
+        bytes = 0;
+    } else if (typeof raw === 'string') {
+        bytes = utf8ByteLength(raw);
+    } else {
+        let serialized: string;
+        try {
+            serialized = JSON.stringify(raw);
+        } catch {
+            throw new TRPCError({ code: 'BAD_REQUEST', message: 'invalid share-link request' });
+        }
+        bytes = utf8ByteLength(serialized);
+    }
+
+    if (bytes > MAX_SHARE_LINK_REQUEST_BYTES) {
+        throw new TRPCError({
+            code: 'PAYLOAD_TOO_LARGE',
+            message: 'share-link request exceeds the 1 MiB limit',
+        });
+    }
+
+    return next({ ctx });
+});
+
+export const openRoute = t.procedure
+    .use(t.middleware(sentryInputCaptureMiddleware))
+    .use(sentryTransactionNameMiddleware);
+
+/**
+ * LC-2187 public share-link paths must never be cached by an intermediary or a
+ * browser. tRPC has no per-procedure header API, so the actual HTTP adapters
+ * (Fastify and Lambda, both tRPC and OpenAPI) apply `Cache-Control` from the
+ * resolved procedure path through this single helper.
+ */
+export const PUBLIC_SHARE_LINK_ROUTE_PREFIX = 'publicShareLinks.';
+
+export const publicShareLinkCacheControlHeaders = (
+    paths: readonly string[] | undefined
+): Record<string, string> =>
+    (paths ?? []).some(path => path.startsWith(PUBLIC_SHARE_LINK_ROUTE_PREFIX))
+        ? { 'Cache-Control': 'private, no-store' }
+        : {};
+
+/**
+ * Route base for procedures whose input carries owner-private material (titles,
+ * notes, ciphertext envelopes, recovery JWEs) and whose error paths must not
+ * attach raw request bodies to Sentry. It runs the same Sentry error/transaction
+ * handling but with input attachment disabled, so no branch — malformed,
+ * unauthenticated or failing — can capture the payload, and it enforces the
+ * complete-request byte bound before input parsing.
+ */
+export const openRouteWithoutInputCapture = t.procedure
+    .use(t.middleware(sentryNoInputCaptureMiddleware))
+    .use(sentryTransactionNameMiddleware)
+    .use(enforceShareLinkRequestByteBound);
 
 export const resolveProfileFromContextDid = async (
     didFromContext: string | undefined,
@@ -316,27 +396,33 @@ const resolveActAs = async (
     return { ...user, profile: target, did: target.did, onBehalfOf: profile.profileId };
 };
 
-export const didRoute = openRoute.use(async ({ ctx, next }) => {
-    if (!ctx.user?.did) {
-        throw new TRPCError({ code: 'UNAUTHORIZED' });
-    }
+const withDid = (base: typeof openRoute) =>
+    base.use(async ({ ctx, next }) => {
+        if (!ctx.user?.did) {
+            throw new TRPCError({ code: 'UNAUTHORIZED' });
+        }
 
-    const profile = await resolveProfileFromContextDid(ctx.user.did, ctx.domain);
+        const profile = await resolveProfileFromContextDid(ctx.user.did, ctx.domain);
 
-    if (profile) Sentry.setUser({ id: profile.profileId, username: profile.displayName });
+        if (profile) Sentry.setUser({ id: profile.profileId, username: profile.displayName });
 
-    const user = ctx.user.isChallengeValid
-        ? await resolveActAs({ ...ctx.user, profile }, ctx.actAs, ctx.domain)
-        : { ...ctx.user, profile };
+        const user = ctx.user.isChallengeValid
+            ? await resolveActAs({ ...ctx.user, profile }, ctx.actAs, ctx.domain)
+            : { ...ctx.user, profile };
 
-    return next({ ctx: { ...ctx, user } });
-});
+        return next({ ctx: { ...ctx, user } });
+    });
 
-export const didAndChallengeRoute = didRoute.use(({ ctx, next }) => {
-    if (!ctx.user?.isChallengeValid) throw new TRPCError({ code: 'UNAUTHORIZED' });
+export const didRoute = withDid(openRoute);
 
-    return next({ ctx: { ...ctx, user: ctx.user } });
-});
+const withChallenge = (base: typeof didRoute) =>
+    base.use(({ ctx, next }) => {
+        if (!ctx.user?.isChallengeValid) throw new TRPCError({ code: 'UNAUTHORIZED' });
+
+        return next({ ctx: { ...ctx, user: ctx.user } });
+    });
+
+export const didAndChallengeRoute = withChallenge(didRoute);
 
 export const scopedRoute = didAndChallengeRoute.use(({ ctx, next, meta }) => {
     if (!meta?.requiredScope) {
@@ -370,33 +456,41 @@ export const openProfileRoute = didRoute.use(async ({ ctx, next }) => {
     return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
 });
 
-export const profileRoute = didAndChallengeRoute.use(async ({ ctx, next, meta }) => {
-    const { profile } = ctx.user;
+const withProfile = (base: typeof didAndChallengeRoute) =>
+    base.use(async ({ ctx, next, meta }) => {
+        const { profile } = ctx.user;
 
-    if (!profile) {
-        throw new TRPCError({
-            code: 'NOT_FOUND',
-            message: 'Profile not found. Please make a profile!',
-        });
-    }
+        if (!profile) {
+            throw new TRPCError({
+                code: 'NOT_FOUND',
+                message: 'Profile not found. Please make a profile!',
+            });
+        }
 
-    if (!meta?.requiredScope) {
-        return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
-    }
+        if (!meta?.requiredScope) {
+            return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
+        }
 
-    const userScope = ctx.user?.scope || AUTH_GRANT_NO_ACCESS_SCOPE;
+        const userScope = ctx.user?.scope || AUTH_GRANT_NO_ACCESS_SCOPE;
 
-    const hasRequiredScope = userHasRequiredScopes(userScope, meta.requiredScope);
+        const hasRequiredScope = userHasRequiredScopes(userScope, meta.requiredScope);
 
-    if (!hasRequiredScope) {
-        throw new TRPCError({
-            code: 'UNAUTHORIZED',
-            message: `This operation requires ${meta.requiredScope} scope`,
-        });
-    }
+        if (!hasRequiredScope) {
+            throw new TRPCError({
+                code: 'UNAUTHORIZED',
+                message: `This operation requires ${meta.requiredScope} scope`,
+            });
+        }
 
-    return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
-});
+        return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
+    });
+
+export const profileRoute = withProfile(didAndChallengeRoute);
+
+/** Same auth chain, composed on a base that never attaches private RPC input to Sentry. */
+export const didRouteWithoutInputCapture = withDid(openRouteWithoutInputCapture);
+export const didAndChallengeRouteWithoutInputCapture = withChallenge(didRouteWithoutInputCapture);
+export const profileRouteWithoutInputCapture = withProfile(didAndChallengeRouteWithoutInputCapture);
 
 export const openProfileManagerRoute = openRoute.use(async ({ ctx, next }) => {
     if (!ctx.user?.did) throw new TRPCError({ code: 'UNAUTHORIZED' });
@@ -460,7 +554,8 @@ const GUARDIAN_APPROVAL_CLOCK_SKEW_SECONDS = 60;
 export const guardianGatedRoute = profileRoute.use(async ({ ctx, next }) => {
     const { profile } = ctx.user;
     const guardianApprovalToken = ctx._guardianApprovalToken;
-    const isChildAccount = await isProfileManaged(profile.profileId);
+    // Service profiles (orgs) are managed for admin purposes, not guardianship.
+    const isChildAccount = !profile.isServiceProfile && (await isProfileManaged(profile.profileId));
     let guardianIdentity: { profileId: string; did: string } | undefined;
 
     if (isChildAccount && guardianApprovalToken) {