@learncard/network-brain-service 3.19.1 → 4.0.1

package/src/helpers/inline-template.helpers.ts

@@ -0,0 +1,560 @@
+import crypto from 'node:crypto';
+
+import { z } from 'zod';
+import { TRPCError } from '@trpc/server';
+import type { UnsignedVC } from '@learncard/types';
+import type { InlineCredentialTemplate, VariableManifest } from '@learncard/partner-connect-core';
+import {
+    canonicalJsonString,
+    compileInlineTemplate,
+    validateInlineTemplate,
+    validateTemplateData,
+} from '@learncard/partner-connect-core';
+
+import { getBoostUri } from '@helpers/boost.helpers';
+import { getAppDidWeb, getDidWeb } from '@helpers/did.helpers';
+import { getDidWebLearnCard, getLearnCard } from '@helpers/learnCard.helpers';
+import { inflateObject } from '@helpers/objects.helpers';
+import { createBoostForListing } from '@accesslayer/boost/create';
+import { updateBoost } from '@accesslayer/boost/update';
+import { removeBoostFromListing } from '@accesslayer/app-store-listing/relationships/delete';
+import {
+    associateBoostWithListing,
+    associateListingWithSigningAuthority,
+} from '@accesslayer/app-store-listing/relationships/create';
+import { getBoostForListingByTemplateAlias } from '@accesslayer/app-store-listing/relationships/read';
+import { upsertSigningAuthority } from '@accesslayer/signing-authority/create';
+import { createUseSigningAuthorityRelationship } from '@accesslayer/signing-authority/relationships/create';
+import {
+    getPrimarySigningAuthorityForListing,
+    getPrimarySigningAuthorityForIntegration,
+    getPrimarySigningAuthorityForUser,
+} from '@accesslayer/signing-authority/relationships/read';
+import {
+    invalidateBoostForListingCache,
+    invalidateListingSigningAuthorityCache,
+} from '@cache/app-store.caches';
+import { deleteDidDocForProfile } from '@cache/did-docs';
+import { neogma } from '@instance';
+import { environment } from '@environment';
+import { Boost, type BoostInstance } from '@models';
+import type { AppStoreListingType } from 'types/app-store-listing';
+import type { IntegrationType } from 'types/integration';
+import type { ProfileType, SigningAuthorityForUserType } from 'types/profile';
+
+type InlineTemplateBoostMeta = {
+    integrationId?: string;
+    templateAlias?: string;
+    inlineTemplateHash?: string;
+    inlineTemplateVersion?: number;
+    inlineVariableManifest?: string;
+    source?: string;
+    supersededAt?: string;
+    supersededBy?: string;
+};
+
+type UpsertInlineTemplateBoostResult = {
+    boost: BoostInstance;
+    boostUri: string;
+    templateVersion: number;
+    manifest: VariableManifest;
+};
+
+const INLINE_TEMPLATE_SOURCE = 'partner-connect-inline';
+const DEFAULT_SIGNING_AUTHORITY_ENDPOINT =
+    environment.SIGNING_AUTHORITY_ENDPOINT ?? 'http://localhost:5100/api';
+const MAX_SIGNING_AUTHORITY_NAME_LENGTH = 15;
+const SIGNING_AUTHORITY_PREFIX = 'app-';
+
+const getBoostMeta = (boost: BoostInstance): InlineTemplateBoostMeta => {
+    const inflated = inflateObject<Record<string, unknown>>(
+        boost.getDataValues() as Record<string, unknown>
+    );
+    return (inflated.meta as InlineTemplateBoostMeta | undefined) ?? {};
+};
+
+export const readInlineTemplateBoostMeta = async (
+    boostOrId: BoostInstance | string
+): Promise<InlineTemplateBoostMeta> => {
+    const boostId = typeof boostOrId === 'string' ? boostOrId : boostOrId.id;
+    const inMemoryMeta = typeof boostOrId === 'string' ? undefined : getBoostMeta(boostOrId);
+
+    if (
+        inMemoryMeta?.inlineTemplateHash ||
+        typeof inMemoryMeta?.inlineTemplateVersion === 'number' ||
+        inMemoryMeta?.templateAlias
+    ) {
+        return inMemoryMeta;
+    }
+
+    const result = await neogma.queryRunner.run(
+        `MATCH (boost:Boost {id: $boostId})
+         RETURN boost.\`meta.integrationId\` AS integrationId,
+                boost.\`meta.templateAlias\` AS templateAlias,
+                boost.\`meta.inlineTemplateHash\` AS inlineTemplateHash,
+                boost.\`meta.inlineTemplateVersion\` AS inlineTemplateVersion,
+                boost.\`meta.inlineVariableManifest\` AS inlineVariableManifest,
+                boost.\`meta.source\` AS source,
+                boost.\`meta.supersededAt\` AS supersededAt,
+                boost.\`meta.supersededBy\` AS supersededBy`,
+        { boostId }
+    );
+
+    const record = result.records[0];
+
+    if (!record) {
+        return {};
+    }
+
+    const rawVersion = record.get('inlineTemplateVersion') as { toNumber?: () => number } | number;
+
+    return {
+        integrationId: record.get('integrationId') ?? undefined,
+        templateAlias: record.get('templateAlias') ?? undefined,
+        inlineTemplateHash: record.get('inlineTemplateHash') ?? undefined,
+        inlineTemplateVersion:
+            typeof rawVersion === 'number' ? rawVersion : rawVersion?.toNumber?.(),
+        inlineVariableManifest: record.get('inlineVariableManifest') ?? undefined,
+        source: record.get('source') ?? undefined,
+        supersededAt: record.get('supersededAt') ?? undefined,
+        supersededBy: record.get('supersededBy') ?? undefined,
+    };
+};
+
+const joinTemplateErrors = (errors: Array<{ message: string }>): string => {
+    return errors.map(error => error.message).join('; ');
+};
+
+export const getInlineTemplateVersion = (boost: BoostInstance): number | undefined => {
+    const version = getBoostMeta(boost).inlineTemplateVersion;
+    return typeof version === 'number' && Number.isFinite(version) ? version : undefined;
+};
+
+export const getInlineTemplateHashForBoost = (boost: BoostInstance): string | undefined => {
+    const inlineTemplateHash = getBoostMeta(boost).inlineTemplateHash;
+    return typeof inlineTemplateHash === 'string' ? inlineTemplateHash : undefined;
+};
+
+export const isInlineTemplateBoostVersionMatch = (
+    boost: BoostInstance,
+    templateHash: string,
+    templateVersion: number
+): boolean => {
+    return (
+        getInlineTemplateHashForBoost(boost) === templateHash &&
+        getInlineTemplateVersion(boost) === templateVersion
+    );
+};
+
+export const computeInlineTemplateHash = (
+    template: InlineCredentialTemplate
+): {
+    credentialTemplateJson: string;
+    variableManifest: VariableManifest;
+    category: string;
+    walletSkills?: unknown;
+    contentHash: string;
+} => {
+    const compiled = compileInlineTemplate(template);
+    const contentHash = crypto
+        .createHash('sha256')
+        .update(
+            canonicalJsonString({
+                credentialTemplateJson: compiled.credentialTemplateJson,
+                category: compiled.category,
+                walletSkills: compiled.walletSkills,
+            })
+        )
+        .digest('hex');
+
+    return {
+        ...compiled,
+        contentHash,
+    };
+};
+
+export const validateInlineTemplateOrThrow = (template: InlineCredentialTemplate): void => {
+    const errors = validateInlineTemplate(template);
+
+    if (errors.length === 0) {
+        return;
+    }
+
+    throw new TRPCError({
+        code: 'BAD_REQUEST',
+        message: `TEMPLATE_INVALID: ${joinTemplateErrors(errors)}`,
+    });
+};
+
+export const validateInlineTemplateDataOrThrow = (
+    manifest: VariableManifest,
+    templateData: Record<string, unknown> | undefined
+): void => {
+    const errors = validateTemplateData(manifest, templateData);
+
+    if (errors.length === 0) {
+        return;
+    }
+
+    throw new TRPCError({
+        code: 'BAD_REQUEST',
+        message: `TEMPLATE_DATA_INVALID: ${joinTemplateErrors(errors)}`,
+    });
+};
+
+const ensureListingSigningAuthorityRelationship = async (
+    listing: AppStoreListingType,
+    signingAuthority: SigningAuthorityForUserType
+): Promise<void> => {
+    const listingSigningAuthority = await getPrimarySigningAuthorityForListing(listing);
+
+    if (
+        listingSigningAuthority &&
+        listingSigningAuthority.signingAuthority.endpoint ===
+            signingAuthority.signingAuthority.endpoint &&
+        listingSigningAuthority.relationship.name === signingAuthority.relationship.name &&
+        listingSigningAuthority.relationship.did === signingAuthority.relationship.did
+    ) {
+        return;
+    }
+
+    await associateListingWithSigningAuthority(
+        listing.listing_id,
+        signingAuthority.signingAuthority.endpoint,
+        {
+            name: signingAuthority.relationship.name,
+            did: signingAuthority.relationship.did,
+            isPrimary: true,
+        }
+    );
+
+    invalidateListingSigningAuthorityCache(listing.listing_id);
+};
+
+const buildManagedSigningAuthorityName = (listing: AppStoreListingType): string => {
+    const base = (listing.slug || listing.listing_id).toLowerCase().replace(/[^a-z0-9-]/g, '');
+    const trimmed = base.slice(
+        0,
+        MAX_SIGNING_AUTHORITY_NAME_LENGTH - SIGNING_AUTHORITY_PREFIX.length
+    );
+    return `${SIGNING_AUTHORITY_PREFIX}${trimmed || 'app'}`.slice(
+        0,
+        MAX_SIGNING_AUTHORITY_NAME_LENGTH
+    );
+};
+
+const ManagedSigningAuthorityResponseValidator = z.object({ did: z.string().min(1) });
+
+/**
+ * Gets or creates the app's signing authority through LCA API, which owns key generation
+ * and encrypts the seed at rest. Brain authenticates as a trusted service DID.
+ */
+const provisionManagedSigningAuthority = async (
+    endpoint: string,
+    ownerDid: string,
+    name: string
+): Promise<string> => {
+    // Tests mock signing-authority issuance, so derive a stable DID without calling LCA API.
+    if (environment.NODE_ENV === 'test') {
+        return (await getLearnCard('e'.repeat(64))).id.did();
+    }
+
+    try {
+        const learnCard = await getDidWebLearnCard();
+        const didJwt = await learnCard.invoke.getDidAuthVp({ proofFormat: 'jwt' });
+
+        const response = await fetch(`${endpoint}/signing-authority/managed`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Authorization': `Bearer ${didJwt}`,
+            },
+            body: JSON.stringify({ ownerDid, name }),
+        });
+
+        if (!response.ok) {
+            throw new Error(`LCA API responded with ${response.status}`);
+        }
+
+        return ManagedSigningAuthorityResponseValidator.parse(await response.json()).did;
+    } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new TRPCError({
+            code: 'INTERNAL_SERVER_ERROR',
+            message: `Unable to auto-provision app signing authority: ${message}`,
+            cause: error,
+        });
+    }
+};
+
+export const ensureManagedSigningAuthorityForListing = async (
+    listing: AppStoreListingType,
+    integration: IntegrationType,
+    integrationOwner: ProfileType,
+    domain: string
+): Promise<SigningAuthorityForUserType> => {
+    const existingListingSa = await getPrimarySigningAuthorityForListing(listing);
+    if (existingListingSa) {
+        return existingListingSa;
+    }
+
+    const existingIntegrationSa = await getPrimarySigningAuthorityForIntegration(integration.id);
+    if (existingIntegrationSa) {
+        await ensureListingSigningAuthorityRelationship(listing, existingIntegrationSa);
+        return existingIntegrationSa;
+    }
+
+    const existingOwnerSa = await getPrimarySigningAuthorityForUser(integrationOwner);
+    if (existingOwnerSa) {
+        await ensureListingSigningAuthorityRelationship(listing, existingOwnerSa);
+        return existingOwnerSa;
+    }
+
+    const ownerDid = listing.slug
+        ? getAppDidWeb(domain, listing.slug)
+        : getDidWeb(domain, integrationOwner.profileId);
+    const name = buildManagedSigningAuthorityName(listing);
+    const did = await provisionManagedSigningAuthority(
+        DEFAULT_SIGNING_AUTHORITY_ENDPOINT,
+        ownerDid,
+        name
+    );
+    const signingAuthority = await upsertSigningAuthority(DEFAULT_SIGNING_AUTHORITY_ENDPOINT);
+
+    await createUseSigningAuthorityRelationship(
+        integrationOwner,
+        signingAuthority,
+        name,
+        did,
+        true
+    );
+    await associateListingWithSigningAuthority(
+        listing.listing_id,
+        DEFAULT_SIGNING_AUTHORITY_ENDPOINT,
+        {
+            name,
+            did,
+            isPrimary: true,
+        }
+    );
+    invalidateListingSigningAuthorityCache(listing.listing_id);
+    await deleteDidDocForProfile(integrationOwner.profileId);
+
+    return {
+        signingAuthority: { endpoint: DEFAULT_SIGNING_AUTHORITY_ENDPOINT },
+        relationship: { name, did, isPrimary: true },
+    } as SigningAuthorityForUserType;
+};
+
+const getReusableInlineTemplateBoost = async ({
+    integrationId,
+    templateAlias,
+    contentHash,
+    templateVersion,
+}: {
+    integrationId: string;
+    templateAlias: string;
+    contentHash: string;
+    templateVersion: number;
+}): Promise<BoostInstance | null> => {
+    const result = await neogma.queryRunner.run(
+        `MATCH (boost:Boost)
+         WHERE boost.\`meta.integrationId\` = $integrationId
+           AND boost.\`meta.templateAlias\` = $templateAlias
+           AND boost.\`meta.inlineTemplateHash\` = $contentHash
+           AND boost.\`meta.inlineTemplateVersion\` = $templateVersion
+         RETURN boost.id AS id
+         ORDER BY boost.id DESC
+         LIMIT 1`,
+        {
+            integrationId,
+            templateAlias,
+            contentHash,
+            templateVersion,
+        }
+    );
+
+    const id = result.records[0]?.get('id');
+
+    if (typeof id !== 'string') {
+        return null;
+    }
+
+    return Boost.findOne({ where: { id } });
+};
+
+export const upsertInlineTemplateBoostForListing = async ({
+    listing,
+    integration,
+    templateAlias,
+    template,
+    domain,
+    desiredVersion,
+}: {
+    listing: AppStoreListingType;
+    integration: IntegrationType;
+    templateAlias: string;
+    template: InlineCredentialTemplate;
+    domain: string;
+    desiredVersion?: number;
+}): Promise<UpsertInlineTemplateBoostResult> => {
+    validateInlineTemplateOrThrow(template);
+
+    const { credentialTemplateJson, variableManifest, category, walletSkills, contentHash } =
+        computeInlineTemplateHash(template);
+    const existing = await getBoostForListingByTemplateAlias(
+        listing.listing_id,
+        templateAlias,
+        domain
+    );
+
+    if (existing) {
+        const existingMeta = await readInlineTemplateBoostMeta(existing.boost);
+        const existingVersion =
+            typeof existingMeta.inlineTemplateVersion === 'number'
+                ? existingMeta.inlineTemplateVersion
+                : 1;
+        const targetVersion = desiredVersion ?? existingVersion;
+
+        if (existingMeta.inlineTemplateHash === contentHash && existingVersion === targetVersion) {
+            return {
+                boost: existing.boost,
+                boostUri: existing.boostUri,
+                templateVersion: targetVersion,
+                manifest: variableManifest,
+            };
+        }
+
+        const reusableBoost = await getReusableInlineTemplateBoost({
+            integrationId: integration.id,
+            templateAlias,
+            contentHash,
+            templateVersion: targetVersion,
+        });
+
+        if (reusableBoost) {
+            const reusableBoostUri = getBoostUri(reusableBoost.id, domain);
+
+            await updateBoost(existing.boost, {
+                meta: {
+                    supersededAt: new Date().toISOString(),
+                    supersededBy: reusableBoostUri,
+                },
+            });
+            await removeBoostFromListing(listing.listing_id, templateAlias);
+            await associateBoostWithListing(listing.listing_id, reusableBoostUri, templateAlias);
+            invalidateBoostForListingCache(listing.listing_id, templateAlias, domain);
+
+            return {
+                boost: reusableBoost,
+                boostUri: reusableBoostUri,
+                templateVersion: targetVersion,
+                manifest: variableManifest,
+            };
+        }
+
+        const nextVersion = desiredVersion ?? existingVersion + 1;
+
+        const newBoost = await createBoostForListing(
+            parseInlineTemplateJson(credentialTemplateJson) as UnsignedVC,
+            listing,
+            {
+                status: 'LIVE',
+                category,
+                meta: {
+                    integrationId: integration.id,
+                    templateAlias,
+                    inlineTemplateHash: contentHash,
+                    inlineTemplateVersion: nextVersion,
+                    inlineVariableManifest: JSON.stringify(variableManifest),
+                    inlineWalletSkills: walletSkills ? JSON.stringify(walletSkills) : undefined,
+                    source: INLINE_TEMPLATE_SOURCE,
+                },
+            },
+            domain
+        );
+        const newBoostUri = getBoostUri(newBoost.id, domain);
+
+        await updateBoost(existing.boost, {
+            meta: {
+                supersededAt: new Date().toISOString(),
+                supersededBy: newBoostUri,
+            },
+        });
+        await removeBoostFromListing(listing.listing_id, templateAlias);
+        await associateBoostWithListing(listing.listing_id, newBoostUri, templateAlias);
+        invalidateBoostForListingCache(listing.listing_id, templateAlias, domain);
+
+        return {
+            boost: newBoost,
+            boostUri: newBoostUri,
+            templateVersion: nextVersion,
+            manifest: variableManifest,
+        };
+    }
+
+    const initialVersion = desiredVersion ?? 1;
+
+    const reusableBoost = await getReusableInlineTemplateBoost({
+        integrationId: integration.id,
+        templateAlias,
+        contentHash,
+        templateVersion: initialVersion,
+    });
+
+    if (reusableBoost) {
+        const reusableBoostUri = getBoostUri(reusableBoost.id, domain);
+
+        await associateBoostWithListing(listing.listing_id, reusableBoostUri, templateAlias);
+        invalidateBoostForListingCache(listing.listing_id, templateAlias, domain);
+
+        return {
+            boost: reusableBoost,
+            boostUri: reusableBoostUri,
+            templateVersion: initialVersion,
+            manifest: variableManifest,
+        };
+    }
+
+    const boost = await createBoostForListing(
+        parseInlineTemplateJson(credentialTemplateJson) as UnsignedVC,
+        listing,
+        {
+            status: 'LIVE',
+            category,
+            meta: {
+                integrationId: integration.id,
+                templateAlias,
+                inlineTemplateHash: contentHash,
+                inlineTemplateVersion: initialVersion,
+                inlineVariableManifest: JSON.stringify(variableManifest),
+                inlineWalletSkills: walletSkills ? JSON.stringify(walletSkills) : undefined,
+                source: INLINE_TEMPLATE_SOURCE,
+            },
+        },
+        domain
+    );
+    const boostUri = getBoostUri(boost.id, domain);
+
+    await associateBoostWithListing(listing.listing_id, boostUri, templateAlias);
+    invalidateBoostForListingCache(listing.listing_id, templateAlias, domain);
+
+    return {
+        boost,
+        boostUri,
+        templateVersion: initialVersion,
+        manifest: variableManifest,
+    };
+};
+
+const parseInlineTemplateJson = (templateJson: string): Record<string, unknown> => {
+    try {
+        return JSON.parse(templateJson) as Record<string, unknown>;
+    } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new TRPCError({
+            code: 'INTERNAL_SERVER_ERROR',
+            message: `Compiled inline template produced invalid JSON: ${message}`,
+        });
+    }
+};

package/src/helpers/notificationMessages.ts

@@ -38,6 +38,10 @@ export type NotificationMessageKey =
     | 'appListingWithdrawn'
     | 'appListingApproved'
     | 'appListingRejected'
+    | 'contractRequestReceived'
+    | 'contractRequestAccepted'
+    | 'contractRequestDenied'
+    | 'contractRequestCancelled'
     | 'consentFlowViewRequest'
     | 'consentFlowInvite'
     | 'consentFlowShare'
@@ -149,6 +153,22 @@ const en: LocaleCatalog = {
         title: 'App Listing Needs Changes',
         body: '"{displayName}" was not approved. Please review and resubmit.',
     },
+    contractRequestReceived: {
+        title: 'Connection request',
+        body: '{referrer} would like to connect you with {contractOwner}.',
+    },
+    contractRequestAccepted: {
+        title: 'Connection request accepted',
+        body: '{name} accepted the request.',
+    },
+    contractRequestDenied: {
+        title: 'Connection request declined',
+        body: '{name} declined the request.',
+    },
+    contractRequestCancelled: {
+        title: 'Connection request cancelled',
+        body: '{name} cancelled the request.',
+    },
     consentFlowViewRequest: {
         title: 'AI Insights',
         body: '{name} has requested to view your insights.',
@@ -304,6 +324,22 @@ const es: LocaleCatalog = {
         title: 'La aplicación necesita cambios',
         body: '"{displayName}" no fue aprobada. Revísala y vuelve a enviarla.',
     },
+    contractRequestReceived: {
+        title: 'Solicitud de conexión',
+        body: '{referrer} quiere conectarte con {contractOwner}.',
+    },
+    contractRequestAccepted: {
+        title: 'Solicitud de conexión aceptada',
+        body: '{name} aceptó la solicitud.',
+    },
+    contractRequestDenied: {
+        title: 'Solicitud de conexión rechazada',
+        body: '{name} rechazó la solicitud.',
+    },
+    contractRequestCancelled: {
+        title: 'Solicitud de conexión cancelada',
+        body: '{name} canceló la solicitud.',
+    },
     consentFlowViewRequest: {
         title: 'AI Insights',
         body: '{name} ha solicitado ver tus análisis.',
@@ -459,6 +495,22 @@ const fr: LocaleCatalog = {
         title: "L'application nécessite des modifications",
         body: "« {displayName} » n'a pas été approuvée. Veuillez la réviser et la soumettre à nouveau.",
     },
+    contractRequestReceived: {
+        title: 'Demande de connexion',
+        body: '{referrer} souhaite vous mettre en relation avec {contractOwner}.',
+    },
+    contractRequestAccepted: {
+        title: 'Demande de connexion acceptée',
+        body: '{name} a accepté la demande.',
+    },
+    contractRequestDenied: {
+        title: 'Demande de connexion refusée',
+        body: '{name} a refusé la demande.',
+    },
+    contractRequestCancelled: {
+        title: 'Demande de connexion annulée',
+        body: '{name} a annulé la demande.',
+    },
     consentFlowViewRequest: {
         title: 'AI Insights',
         body: '{name} a demandé à consulter vos analyses.',
@@ -614,6 +666,13 @@ const ar: LocaleCatalog = {
         title: 'التطبيق يحتاج إلى تعديلات',
         body: 'لم تتم الموافقة على "{displayName}". يرجى مراجعته وإعادة إرساله.',
     },
+    contractRequestReceived: {
+        title: 'طلب اتصال',
+        body: 'يريد {referrer} توصيلك بـ {contractOwner}.',
+    },
+    contractRequestAccepted: { title: 'تم قبول طلب الاتصال', body: 'قبل {name} الطلب.' },
+    contractRequestDenied: { title: 'تم رفض طلب الاتصال', body: 'رفض {name} الطلب.' },
+    contractRequestCancelled: { title: 'تم إلغاء طلب الاتصال', body: 'ألغى {name} الطلب.' },
     consentFlowViewRequest: {
         title: 'رؤى الذكاء الاصطناعي',
         body: 'طلب {name} الاطلاع على رؤاك.',

package/src/helpers/notificationQueue.helpers.ts

@@ -1,14 +1,32 @@
-import { LCNNotificationValidator } from '@learncard/types';
+import { authorizeContractNotification } from '@helpers/contract-events.helpers';
+import { ConsentFlowWebhookMetadataValidator, LCNNotificationValidator } from '@learncard/types';
 
 import { acknowledgeConnectionPromptNotificationDelivery } from '@helpers/connectionPrompt.helpers';
-import { sendNotification } from '@helpers/notifications.helpers';
+import {
+    PermanentNotificationDeliveryError,
+    sendNotification,
+} from '@helpers/notifications.helpers';
 
 export const deliverQueuedNotification = async (body: string): Promise<void> => {
     const notification = await LCNNotificationValidator.parseAsync(JSON.parse(body));
 
-    const stored = await sendNotification(notification, {
-        propagateDirectWebhookTransportErrors: true,
-    });
+    if (!(await authorizeContractNotification(notification))) return;
+
+    const isContractEvent = ConsentFlowWebhookMetadataValidator.safeParse(
+        notification.data?.metadata
+    ).success;
+    let stored: boolean | undefined;
+    try {
+        stored = await sendNotification(notification, {
+            propagateDirectWebhookTransportErrors: true,
+            throwOnPermanentFailure: isContractEvent,
+        });
+    } catch (error) {
+        // Acknowledge terminal contract rejections so SQS can discard its payload too.
+        // Other notification types keep their existing worker behavior.
+        if (isContractEvent && error instanceof PermanentNotificationDeliveryError) return;
+        throw error;
+    }
 
     if (!stored) throw new Error('Notification was not durably stored');