@learncard/network-brain-service 3.19.1 → 4.0.0

package/src/helpers/notifications.helpers.ts

@@ -26,8 +26,20 @@ const TIMEOUT = 6000;
 
 type NotificationDeliveryOptions = {
     propagateDirectWebhookTransportErrors?: boolean;
+    /** Opt in to terminal rejection errors; legacy callers continue to receive false. */
+    throwOnPermanentFailure?: boolean;
 };
 
+export class PermanentNotificationDeliveryError extends Error {
+    constructor(
+        readonly reason: 'no_webhook' | 'invalid_webhook' | 'webhook_rejected',
+        readonly statusCode?: number
+    ) {
+        super(`Notification delivery rejected: ${reason}`);
+        this.name = 'PermanentNotificationDeliveryError';
+    }
+}
+
 type NotificationWebhookResponseRecord = Record<string, unknown>;
 
 const isDefinitiveWebhookRejection = (statusCode: number): boolean => {
@@ -308,6 +320,8 @@ export async function sendNotification(
         );
 
         if (!notificationsWebhook) {
+            if (options.throwOnPermanentFailure)
+                throw new PermanentNotificationDeliveryError('no_webhook');
             return false;
         }
 
@@ -360,7 +374,14 @@ export async function sendNotification(
             }
 
             if (!response.ok) {
-                if (isDefinitiveWebhookRejection(response.status)) return false;
+                if (isDefinitiveWebhookRejection(response.status)) {
+                    if (options.throwOnPermanentFailure)
+                        throw new PermanentNotificationDeliveryError(
+                            'webhook_rejected',
+                            response.status
+                        );
+                    return false;
+                }
 
                 throw createWebhookTransportError(response.status);
             }
@@ -411,7 +432,10 @@ export async function sendNotification(
 
             return notificationDelivered;
         }
+        if (options.throwOnPermanentFailure)
+            throw new PermanentNotificationDeliveryError('invalid_webhook');
     } catch (error) {
+        if (error instanceof PermanentNotificationDeliveryError) throw error;
         if (runtimeEnvironment.NODE_ENV !== 'test') {
             console.error('Notifications Helpers - Error While Sending:', error);
         }

package/src/helpers/profile.helpers.ts

@@ -13,6 +13,12 @@ export const PublicProfileIdValidator = LCNProfileValidator.shape.profileId.refi
     { message: 'Profile IDs beginning with "sample-" are reserved.' }
 );
 
+/** Legacy service flags never override an explicit child classification. */
+export const isServiceProfileExemptFromGuardianship = (
+    isServiceProfile: unknown,
+    profileType: unknown
+): boolean => isServiceProfile === true && profileType !== 'child';
+
 /**
  * Gets or creates a federated profile for cross-instance credential sending.
  * Federated profiles use email-like format: profileId@service-domain to avoid collisions.

package/src/helpers/share-link-attachment-access.ts

@@ -0,0 +1,87 @@
+import { createHmac, randomUUID, timingSafeEqual } from 'node:crypto';
+import { getShareLinkRequestHashSecret } from './share-link-lifecycle';
+import type { ShareLinkRecord } from '../models/ShareLink';
+
+const TTL_MS = 60 * 1000;
+const sign = (text: string): string =>
+    createHmac('sha256', getShareLinkRequestHashSecret()).update(text).digest('base64url');
+const binding = (record: ShareLinkRecord, namespace: string, sourceIp?: string): string =>
+    sign(
+        JSON.stringify([
+            'attachment-access-v1',
+            namespace,
+            record.ownerProfileId,
+            record.id,
+            record.contentVersion,
+            record.attachmentId,
+            record.attachmentChunkCount,
+            record.passcodeHash ?? null,
+            sourceIp ?? null,
+        ])
+    );
+
+/** Opaque keyed binding never exposes the password verifier or internal owner/namespace. */
+export const mintShareAttachmentAccessToken = (
+    record: ShareLinkRecord,
+    namespace: string,
+    sourceIp: string | undefined,
+    now: Date
+): string => {
+    const body = Buffer.from(
+        JSON.stringify({
+            v: 1,
+            expiresAt: now.getTime() + TTL_MS,
+            nonce: randomUUID(),
+            binding: binding(record, namespace, sourceIp),
+        })
+    ).toString('base64url');
+    return `${body}.${sign(`attachment-grant-v1:${body}`)}`;
+};
+
+/** A grant only amortizes a successful password check; active/current authorization remains mandatory. */
+export const verifyShareAttachmentAccessToken = (
+    token: string,
+    record: ShareLinkRecord,
+    namespace: string,
+    sourceIp: string | undefined,
+    now: Date
+): boolean => {
+    try {
+        const parts = token.split('.');
+        const bodyPart = parts[0];
+        const signature = parts[1];
+        if (
+            parts.length !== 2 ||
+            !bodyPart ||
+            !signature ||
+            signature.length !== 43 ||
+            token.length > 2048
+        )
+            return false;
+        const bytes = Buffer.from(bodyPart, 'base64url');
+        if (bytes.toString('base64url') !== bodyPart) return false;
+        const actual = Buffer.from(signature, 'base64url');
+        const expected = Buffer.from(sign(`attachment-grant-v1:${bodyPart}`), 'base64url');
+        if (
+            actual.length !== expected.length ||
+            actual.toString('base64url') !== signature ||
+            !timingSafeEqual(actual, expected)
+        )
+            return false;
+        const body: unknown = JSON.parse(bytes.toString('utf8'));
+        if (!body || typeof body !== 'object' || Array.isArray(body)) return false;
+        const value = body as Record<string, unknown>;
+        if (
+            value.v !== 1 ||
+            typeof value.expiresAt !== 'number' ||
+            !Number.isSafeInteger(value.expiresAt) ||
+            value.expiresAt <= now.getTime() ||
+            value.expiresAt > now.getTime() + TTL_MS ||
+            value.binding !== binding(record, namespace, sourceIp)
+        )
+            return false;
+        return true;
+    } catch {
+        return false;
+    }
+};

package/src/helpers/share-link-attachment.ts

@@ -0,0 +1,115 @@
+import {
+    PutShareLinkAttachmentChunkInputValidator,
+    DeleteShareLinkAttachmentChunksInputValidator,
+} from '@learncard/types';
+import type {
+    PutShareLinkAttachmentChunkInput,
+    DeleteShareLinkAttachmentChunksInput,
+} from '@learncard/types';
+import type { ShareContentClient } from './share-content-client';
+import {
+    beginShareAttachmentChunk,
+    completeShareAttachmentChunk,
+    deleteUnreferencedShareAttachment,
+    shareAttachmentTuple,
+    type ShareAttachmentBinding,
+} from '../accesslayer/share-link/attachment';
+import { ShareLinkCoordinatorError } from './share-link-coordinator/types';
+import type { ShareOwnerContext } from './share-link-coordinator/types';
+import { isShareLinkRepositoryError } from '../accesslayer/share-link/errors';
+
+export type ShareLinkAttachmentOwnerApi = {
+    put: (
+        input: PutShareLinkAttachmentChunkInput,
+        owner: ShareOwnerContext
+    ) => Promise<{ ok: true }>;
+    delete: (
+        input: DeleteShareLinkAttachmentChunksInput,
+        owner: ShareOwnerContext
+    ) => Promise<{ ok: boolean }>;
+};
+
+export const createShareLinkAttachmentOwnerApi = (
+    client: Pick<ShareContentClient, 'put' | 'delete'>,
+    repository = {
+        begin: beginShareAttachmentChunk,
+        complete: completeShareAttachmentChunk,
+        deleteUnreferenced: deleteUnreferencedShareAttachment,
+    }
+): ShareLinkAttachmentOwnerApi => {
+    const bindingFor = (
+        input: DeleteShareLinkAttachmentChunksInput,
+        owner: ShareOwnerContext
+    ): ShareAttachmentBinding => ({
+        namespace: owner.namespace,
+        ownerProfileId: owner.ownerProfileId,
+        shareId: input.id,
+        contentVersion: input.contentVersion,
+        attachmentId: input.attachmentId,
+        chunkCount: input.chunkCount,
+    });
+    return {
+        put: async (input, owner) => {
+            const parsed = PutShareLinkAttachmentChunkInputValidator.safeParse(input);
+            if (!parsed.success)
+                throw new ShareLinkCoordinatorError('INVALID_INPUT', 'invalid attachment');
+            const value = parsed.data;
+            const binding = bindingFor(value, owner);
+            try {
+                await repository.begin(binding, value.chunkIndex);
+                const result = await client.put({
+                    ...shareAttachmentTuple(binding, value.chunkIndex),
+                    envelope: value.envelope,
+                    ownerEncryptedRecovery: value.ownerEncryptedRecovery,
+                });
+                if (!result.ok)
+                    throw new ShareLinkCoordinatorError(
+                        result.error === 'CONFLICT' ? 'CONFLICT' : 'UNAVAILABLE',
+                        'attachment upload unavailable'
+                    );
+                await repository.complete(binding, value.chunkIndex);
+                return { ok: true };
+            } catch (error) {
+                if (error instanceof ShareLinkCoordinatorError) throw error;
+                const code = isShareLinkRepositoryError(error) ? error.code : undefined;
+                throw new ShareLinkCoordinatorError(
+                    code === 'CONFLICT'
+                        ? 'CONFLICT'
+                        : code === 'NOT_FOUND'
+                          ? 'NOT_FOUND'
+                          : code === 'PRECONDITION_FAILED' || code === 'INVALID_INPUT'
+                            ? code
+                            : 'UNAVAILABLE',
+                    'attachment upload unavailable'
+                );
+            }
+        },
+        delete: async (input, owner) => {
+            const parsed = DeleteShareLinkAttachmentChunksInputValidator.safeParse(input);
+            if (!parsed.success)
+                throw new ShareLinkCoordinatorError('INVALID_INPUT', 'invalid attachment');
+            const binding = bindingFor(parsed.data, owner);
+            let allowed: boolean;
+            try {
+                allowed = await repository.deleteUnreferenced(binding);
+            } catch {
+                throw new ShareLinkCoordinatorError(
+                    'UNAVAILABLE',
+                    'attachment cleanup unavailable'
+                );
+            }
+            if (!allowed) return { ok: false };
+            // Durable jobs were queued before I/O; interrupted/failed deletes are retried by maintenance.
+            let ok = true;
+            for (let index = 0; index < binding.chunkCount; index++) {
+                try {
+                    const result = await client.delete(shareAttachmentTuple(binding, index));
+                    if (!result.ok) ok = false;
+                } catch {
+                    ok = false;
+                }
+            }
+            return { ok };
+        },
+    };
+};

package/src/helpers/share-link-coordinator/attachment-stat.ts

@@ -0,0 +1,41 @@
+import { shareAttachmentTuple } from '../../accesslayer/share-link/attachment';
+import type { ShareLinkReservationRecord } from '../../accesslayer/share-link/types';
+import type { ShareContentClient } from '../share-content-client';
+import type { MaintenanceBudget } from './types';
+import { budgetAllows } from './budget-helpers';
+
+/** Verify the complete immutable set before releasing the atomic commit fence. */
+export const verifyShareAttachmentStats = async (
+    client: Pick<ShareContentClient, 'stat'>,
+    reservation: ShareLinkReservationRecord,
+    budget?: MaintenanceBudget,
+    remoteAndFinalizeCostMs = 0
+): Promise<boolean> => {
+    if (reservation.contentVersion === null || !reservation.attachmentId) return true;
+    const count = reservation.attachmentChunkCount;
+    if (!count || count < 1 || count > 16) return false;
+    const binding = {
+        namespace: reservation.namespace,
+        ownerProfileId: reservation.ownerProfileId,
+        shareId: reservation.shareId,
+        contentVersion: reservation.contentVersion,
+        attachmentId: reservation.attachmentId,
+        chunkCount: count,
+    };
+    for (let index = 0; index < count; index++) {
+        // Each bounded HTTP call must leave enough time for finalization and the
+        // pass reserve. A many-chunk asset cannot overrun the maintenance budget.
+        if (!budgetAllows(budget, remoteAndFinalizeCostMs)) return false;
+        const tuple = shareAttachmentTuple(binding, index);
+        const result = await client.stat(tuple);
+        if (!result.ok || result.value.kind !== 'active') return false;
+        const active = result.value;
+        if (
+            Object.entries(tuple).some(
+                ([key, value]) => active[key as keyof typeof active] !== value
+            )
+        )
+            return false;
+    }
+    return true;
+};

package/src/helpers/share-link-coordinator/coordinator.ts

@@ -28,6 +28,7 @@ import type {
     ShareContentEnvelope,
 } from '../share-content-client/types';
 import { verifyShareContentActiveStat as verifyActiveStat } from './stat';
+import { verifyShareAttachmentStats } from './attachment-stat';
 import {
     ShareLinkCoordinatorError,
     type PendingShareContentOperation,
@@ -162,8 +163,11 @@ export const createShareLinkCoordinator = (
     const policyResolver: ShareLinkPolicyResolver =
         dependencies.policyResolver ??
         createShareLinkPolicyResolver({
-            resolveOwnerAge: async () => 'unknown',
-            isManaged: async () => false,
+            resolveOwner: async () => ({
+                age: 'unknown',
+                isManaged: false,
+                isServiceProfile: false,
+            }),
         });
 
     const finalizeOrPending = async (
@@ -171,7 +175,14 @@ export const createShareLinkCoordinator = (
         objectRef: string | null
     ): Promise<ShareLinkCommitResult> => {
         try {
+            if (!(await verifyShareAttachmentStats(client, reservation))) {
+                return { status: 'pending', reservation, reason: 'stat_missing' };
+            }
             const finalized = await repository.finalizeReservation({
+                verifiedAttachmentId:
+                    reservation.contentVersion !== null
+                        ? (reservation.attachmentId ?? undefined)
+                        : undefined,
                 namespace: reservation.namespace,
                 ownerProfileId: reservation.ownerProfileId,
                 shareId: reservation.shareId,
@@ -336,6 +347,7 @@ export const createShareLinkCoordinator = (
                     // policy that disables view counting for minors/unknown age.
                     notifyOnView: value.notifyOnView && policy.viewCountingEnabled,
                     content,
+                    attachment: value.attachment,
                     requestHash,
                     policy,
                     leaseOwner: dependencies.leaseOwner,
@@ -397,6 +409,7 @@ export const createShareLinkCoordinator = (
                                   ),
                                   contentVersion: value.contentVersion!,
                                   selectedCount: value.selectedCount!,
+                                  attachment: value.attachment,
                               },
                           }
                         : {}),

package/src/helpers/share-link-coordinator/recovery-runner.ts

@@ -7,6 +7,7 @@ import type { ShareLinkRecord } from '../../models/ShareLink';
 import { isTransientShareContentError } from '../share-content-client/types';
 import { budgetAllows, budgetHasUnitReserve, boundTransactionTimeout } from './budget-helpers';
 import { verifyShareContentActiveStat } from './stat';
+import { verifyShareAttachmentStats } from './attachment-stat';
 import {
     ShareLinkCoordinatorError,
     type RecoveryRunnerDependencies,
@@ -102,7 +103,21 @@ const finalizeClaimedReservation = async (
     dependencies: RecoveryRunnerDependencies
 ): Promise<RecoveryDriveOutcome> => {
     try {
+        if (
+            !(await verifyShareAttachmentStats(
+                dependencies.client,
+                reservation,
+                dependencies.budget,
+                recoveryRemoteCostMs(dependencies)
+            ))
+        ) {
+            return { kind: 'deferred', category: 'deferred_stat_mismatch' };
+        }
         const finalized = await dependencies.repository.finalizeReservation({
+            verifiedAttachmentId:
+                reservation.contentVersion !== null
+                    ? (reservation.attachmentId ?? undefined)
+                    : undefined,
             namespace: reservation.namespace,
             ownerProfileId: reservation.ownerProfileId,
             shareId: reservation.shareId,

package/src/helpers/share-link-maintenance/runner.ts

@@ -29,6 +29,7 @@ export type ShareLinkMaintenanceRunnerDependencies = {
      * never load the Neo4j `@instance`; production passes the real repository.
      */
     pruneReceipts: (input: PruneShareViewReceiptsInput) => Promise<number>;
+    expireAttachmentStages?: typeof import('../../accesslayer/share-link/attachment').expireShareAttachmentStages;
     client: Pick<ShareContentClient, 'stat' | 'delete'>;
     logger: ShareLinkMaintenanceLogger;
     /** Monotonic clock for the cooperative budget; injectable for tests. */
@@ -124,6 +125,8 @@ export const runShareLinkMaintenancePass = async (
     let budgetStoppedRecovery = false;
     let budgetStoppedCleanup = false;
     let budgetStoppedReceiptPrune = false;
+    let attachmentStages: ShareLinkMaintenanceRunSummary['attachmentStages'];
+    let stageFailed = false;
 
     if (budgetAllows(budget, recoveryDiscoveryCostMs(config))) {
         recoveryAttempted = true;
@@ -149,6 +152,27 @@ export const runShareLinkMaintenancePass = async (
         budgetStoppedRecovery = true;
     }
 
+    if (dependencies.expireAttachmentStages) {
+        if (budgetAllows(budget, config.graphTimeoutMs)) {
+            try {
+                attachmentStages = {
+                    queued: await dependencies.expireAttachmentStages({
+                        namespace: config.namespace,
+                        limit: 10,
+                        now: dependencies.now?.(),
+                        transaction: { timeoutMs: config.graphTimeoutMs, noInlineRetry: true },
+                    }),
+                };
+            } catch {
+                attachmentStages = null;
+                stageFailed = true;
+                categories.share_link_maintenance_attachment_stage_failed = 1;
+            }
+        } else {
+            budgetStoppedCleanup = true;
+        }
+    }
+
     if (budgetAllows(budget, cleanupUnitCostMs(config))) {
         cleanupAttempted = true;
 
@@ -196,6 +220,7 @@ export const runShareLinkMaintenancePass = async (
     }
 
     const failed =
+        stageFailed ||
         (recoveryAttempted && recovery === null) ||
         (cleanupAttempted && cleanup === null) ||
         (receiptPruneAttempted && receiptPrune === null);
@@ -214,6 +239,9 @@ export const runShareLinkMaintenancePass = async (
         recovery,
         cleanup,
         receiptPrune,
+        ...(dependencies.expireAttachmentStages
+            ? { attachmentStages: attachmentStages ?? null }
+            : {}),
         categories,
     };
 

package/src/helpers/share-link-maintenance/runtime.ts

@@ -17,6 +17,7 @@ import type {
 type MaintenanceClient = Pick<ShareContentClient, 'stat' | 'delete'>;
 
 type ResolvedRunnerDependencies = {
+    expireAttachmentStages?: typeof import('../../accesslayer/share-link/attachment').expireShareAttachmentStages;
     recoveryRepository: RecoveryRunnerDependencies['repository'];
     cleanupRepository: CleanupRunnerDependencies['repository'];
     pruneReceipts: (input: PruneShareViewReceiptsInput) => Promise<number>;
@@ -58,6 +59,7 @@ export type CreateShareLinkMaintenanceRuntimeOptions = {
         recoveryRepository: RecoveryRunnerDependencies['repository'];
         cleanupRepository: CleanupRunnerDependencies['repository'];
         pruneReceipts: ResolvedRunnerDependencies['pruneReceipts'];
+        expireAttachmentStages?: ResolvedRunnerDependencies['expireAttachmentStages'];
     }>;
 };
 
@@ -245,6 +247,7 @@ export const createShareLinkMaintenanceRuntime = (
                 recoveryRepository: setup.dependencies.recoveryRepository,
                 cleanupRepository: setup.dependencies.cleanupRepository,
                 pruneReceipts: setup.dependencies.pruneReceipts,
+                expireAttachmentStages: setup.dependencies.expireAttachmentStages,
                 client: setup.dependencies.client,
                 logger,
                 monotonicNow: options.monotonicNow,
@@ -297,6 +300,7 @@ const buildRuntimeRepositories = async (
     recoveryRepository: RecoveryRunnerDependencies['repository'];
     cleanupRepository: CleanupRunnerDependencies['repository'];
     pruneReceipts: ResolvedRunnerDependencies['pruneReceipts'];
+    expireAttachmentStages?: ResolvedRunnerDependencies['expireAttachmentStages'];
 }> => {
     const runtimeModule = await import('../share-link-coordinator/runtime');
 
@@ -325,6 +329,8 @@ const buildRuntimeRepositories = async (
         recoveryRepository: recoveryDependencies.repository,
         cleanupRepository: cleanupDependencies.repository,
         pruneReceipts: pruneShareViewReceipts,
+        expireAttachmentStages: (await import('../../accesslayer/share-link/attachment'))
+            .expireShareAttachmentStages,
     };
 };
 

package/src/helpers/share-link-maintenance/telemetry.ts

@@ -39,6 +39,9 @@ export const toMaintenanceLogEvent = (
         ...recoveryCounts(summary.recovery),
         ...cleanupCounts(summary.cleanup),
         receiptsPruned: summary.receiptPrune?.pruned ?? 0,
+        ...(summary.attachmentStages
+            ? { attachmentStagesQueued: summary.attachmentStages.queued }
+            : {}),
     },
     categories: {
         ...(summary.recovery?.categories ?? {}),

package/src/helpers/share-link-maintenance/types.ts

@@ -50,6 +50,7 @@ export type ShareLinkMaintenanceFailureCategory =
     | 'share_link_maintenance_pass_failed'
     | 'share_link_maintenance_recovery_failed'
     | 'share_link_maintenance_cleanup_failed'
+    | 'share_link_maintenance_attachment_stage_failed'
     | 'share_link_maintenance_receipt_prune_failed'
     | 'share_link_maintenance_initialization_failed'
     | 'share_link_maintenance_configuration_invalid';
@@ -67,6 +68,7 @@ export type ShareLinkMaintenanceRunSummary = {
     cleanup: CleanupRunSummary | null;
     /** Namespace-scoped expired/consumed receipt nodes deleted this pass. */
     receiptPrune: { pruned: number } | null;
+    attachmentStages?: { queued: number } | null;
     categories: Partial<Record<ShareLinkMaintenanceFailureCategory, number>>;
 };
 

package/src/helpers/share-link-owner-projection.ts

@@ -31,6 +31,8 @@ export const toOwnerShareLink = (
         selectedCount: record.selectedCount,
         version: record.version,
         contentVersion: record.contentVersion,
+        attachmentId: record.attachmentId ?? null,
+        attachmentChunkCount: record.attachmentChunkCount ?? null,
         status: record.status,
         contentState: record.contentState,
         createdAt: record.createdAt,

package/src/helpers/share-link-policy/production.ts

@@ -2,14 +2,17 @@ import { getProfileByProfileId } from '@accesslayer/profile/read';
 import { isProfileManaged } from '@accesslayer/profile/relationships/read';
 import type { ShareViewEligibilitySource } from '@accesslayer/share-link/types';
 import type { ShareLinkTransaction } from '@accesslayer/share-link/transaction';
-import { transformProfileId } from '@helpers/profile.helpers';
+import {
+    isServiceProfileExemptFromGuardianship,
+    transformProfileId,
+} from '@helpers/profile.helpers';
 
 import { composeShareLinkPolicy } from './resolver';
-import type { ShareLinkOwnerAge, ShareLinkPolicySnapshot, ShareLinkPolicySource } from './types';
+import type { CurrentShareLinkPolicy, ShareLinkOwnerAge, ShareLinkPolicySource } from './types';
 
 const ADULT_AGE = 18;
 
-/** A missing or malformed birthdate never grants view tracking. */
+/** Classify persisted human age without inventing a birthdate for service profiles. */
 export const ageFromPersistedProfile = (
     profile: { dob?: unknown; type?: unknown } | null,
     now: Date = new Date()
@@ -45,16 +48,23 @@ export const ageFromPersistedProfile = (
 };
 
 /**
- * Profile birthdate is persisted server-side, but self-reported rather than
- * independently verified. Unknown dates and child profiles stay restricted.
+ * Personal profiles require a valid persisted birthdate for tracking. Service
+ * profiles are age-exempt, but an explicit child type always keeps protections.
  */
-export const createProductionShareLinkPolicySource = (options?: {
-    resolveOwnerAge?: (profileId: string) => Promise<ShareLinkOwnerAge>;
-}): ShareLinkPolicySource => ({
-    resolveOwnerAge:
-        options?.resolveOwnerAge ??
-        (async profileId => ageFromPersistedProfile(await getProfileByProfileId(profileId))),
-    isManaged: isProfileManaged,
+export const createProductionShareLinkPolicySource = (): ShareLinkPolicySource => ({
+    resolveOwner: async profileId => {
+        const profile = await getProfileByProfileId(profileId);
+        const isServiceProfile = isServiceProfileExemptFromGuardianship(
+            profile?.isServiceProfile,
+            profile?.type
+        );
+        const isManaged = await isProfileManaged(profileId);
+        return {
+            age: ageFromPersistedProfile(profile),
+            isServiceProfile,
+            isManaged,
+        };
+    },
 });
 
 /** Read current eligibility within the share lock; no request values or network I/O. */
@@ -62,23 +72,33 @@ export const resolveCurrentShareLinkPolicy = async (
     tx: ShareLinkTransaction,
     ownerProfileId: string,
     now: Date
-): Promise<ShareLinkPolicySnapshot> => {
+): Promise<CurrentShareLinkPolicy> => {
     const result = await tx.run(
         `MATCH (p:Profile {profileId: $profileId})
          OPTIONAL MATCH (p)-[:MANAGED_BY]->(directManager:Profile)
          OPTIONAL MATCH (manager:ProfileManager)-[:MANAGES]->(p)
          RETURN p.dob AS dob, p.type AS profileType,
+                p.isServiceProfile AS isServiceProfile,
                 (directManager IS NOT NULL OR manager IS NOT NULL) AS isManaged
          LIMIT 1`,
         { profileId: transformProfileId(ownerProfileId) }
     );
     const record = result.records[0];
-    if (!record) return composeShareLinkPolicy('unknown', true);
+    if (!record) return { ...composeShareLinkPolicy('unknown', true), isServiceProfile: false };
 
-    return composeShareLinkPolicy(
-        ageFromPersistedProfile({ dob: record.get('dob'), type: record.get('profileType') }, now),
-        record.get('isManaged') !== false
+    const profileType = record.get('profileType');
+    const isServiceProfile = isServiceProfileExemptFromGuardianship(
+        record.get('isServiceProfile'),
+        profileType
     );
+    return {
+        ...composeShareLinkPolicy(
+            ageFromPersistedProfile({ dob: record.get('dob'), type: profileType }, now),
+            record.get('isManaged') !== false,
+            isServiceProfile
+        ),
+        isServiceProfile,
+    };
 };
 
 export const productionShareViewEligibilitySource: ShareViewEligibilitySource = {